Bug with <file dest="."/> (using 0template, injector code)

Hi,

When trying to use the <file/> directive to fetch a file from a remote server, if the dest attribute is just "." (which should be valid) we get an exception

  File "/home/mildred/.cache/0install.net/implementations/sha256new_WJTXRQOJFWFYBVFWITHSXEPGWXBX5YTSQXVT5DUT7RMUTIH6ETYQ/zeroinstall/injector/fetch.py", line 467, in download_impl
    ex = ex))
zeroinstall.SafeException: Error
fetching /home/mildred/Projects/0feed-jenkins/jj.xml.template 0: path
'.' is not within the base directory


The problem is in function native_path_within_base in zeroinstall/injector/fetch.py

	native_path = os.path.join(*crossplatform_path.split("/"))
	fullpath = os.path.realpath(os.path.join(base, native_path))
	base = os.path.realpath(base)
	if not fullpath.startswith(base + os.path.sep):
		raise SafeException("path %r is not within the base directory" % (crossplatform_path,))

When dest="." in the XML, which is the crossplatform_path variable in the code, we have the following situation:

fullpath='/tmp/0compile-emK8vf/0template-h_hdo68r'
base='/tmp/0compile-emK8vf/0template-h_hdo68r'

fullpath is within the base directory, both points at the same place. However there is no extra '/' character (os.path.sep) so the check fails and the exception is thrown.

A solution would be to add the condition (fullpath != base), replace the code above with:

	if not fullpath.startswith(base + os.path.sep) and fullpath != base:
		raise SafeException("path %r is not within the base directory" % 

A workaround is also to download the file in a subdirectory.

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot