Remove another attack vector

lib/core/fs.js

@@ -5,6 +5,11 @@ let fs = require('fs-extra');
 let utils = require('../utils/utils.js');
 require('colors');
 
+const pathConfigs = {
+  DAPP_PATH: process.env.DAPP_PATH,
+  EMBARK_PATH: process.env.EMBARK_PATH
+};
+
 function restrictPath(receiver, binding, count, args) {
   const dapp = dappPath();
   const allowedRoots = [
@@ -119,8 +124,8 @@ function removeSync() {
 }
 
 function anchoredPath(envAnchor, ...args) {
-  const anchor = process.env[envAnchor];
+  let anchor = pathConfigs[envAnchor];
-  if (!anchor) {
+  if (!pathConfigs[envAnchor]) {
     console.error(`process.env.${envAnchor} was not set`.bold.red);
     process.exit(1);
   }

test/fs.js

@@ -2,20 +2,17 @@
 const {assert} = require('chai');
 const os = require('os');
 
+process.env.DAPP_PATH = '/home/testuser/src/dapp_path/';
 const fs = require('../lib/core/fs');
 
 describe('fs', () => {
   before(() => {
-    this.oldDappPath = process.env.DAPP_PATH;
-    process.env.DAPP_PATH = '/home/testuser/src/dapp_path/';
-
     this.oldProcessExit = process.exit;
     process.exit = function() {};
   });
 
 
   after(() => {
-    process.env.DAPP_PATH = this.oldDappPath;
     process.exit = this.oldProcessExit;
   });