command_matches_regex: use canonicalized path if user path contains ".."

We already fall back on the canonicalized path if the user-specified
path is relative.  This helps prevent abuse of overly broad command
regular expressions in sudoers.

Reported by Christos Papakonstantinou from Cantina (cantina.xyz)

Author: millert

plugins/sudoers/match_command.c

@@ -475,7 +475,8 @@ command_matches_regex(struct sudoers_context *ctx, const char *sudoers_cmnd,
      *
      * Neither sudoers_cmnd nor user_cmnd are relative to runchroot.
      */
-    if (cmnd[0] != '/' || regex_matches(sudoers_cmnd, cmnd) != ALLOW) {
+    if (cmnd[0] != '/' || sudo_contains_dot_dot(cmnd) ||
+	    regex_matches(sudoers_cmnd, cmnd) != ALLOW) {
 	/* No match, retry using the canonicalized path (if possible). */
 	if (ctx->user.cmnd_dir == NULL)
 	    debug_return_int(DENY);