authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2026-04-20 21:45:12-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2026-04-20 21:45:12-07:00
log74b56501b3ac7421a7ae7bda177b7d1b737242dd
treedc7a9ee07e347234a40f25ca113d8dcd2ce5ba41
parent4636a761cbdae7477dcff73ba1d752069adbc9bd

fetch: fix the check against package paths escaping root

1 files changed, 12 insertions(+), 2 deletions(-)

src/Package/Fetch.zig+12-2
...@@ -56,6 +56,9 @@ location_tok: std.zig.Ast.TokenIndex,...@@ -56,6 +56,9 @@ location_tok: std.zig.Ast.TokenIndex,
56hash_tok: std.zig.Ast.OptionalTokenIndex,56hash_tok: std.zig.Ast.OptionalTokenIndex,
57name_tok: std.zig.Ast.TokenIndex,57name_tok: std.zig.Ast.TokenIndex,
58lazy_status: LazyStatus,58lazy_status: LazyStatus,
59/// Same as `parent_packge_root` except it is unchanged when recursing into
60/// relative file paths (as opposed to URL).
61remote_package_root: Cache.Path,
59parent_package_root: Cache.Path,62parent_package_root: Cache.Path,
60parent_manifest_ast: ?*const std.zig.Ast,63parent_manifest_ast: ?*const std.zig.Ast,
61prog_node: std.Progress.Node,64prog_node: std.Progress.Node,
...@@ -544,8 +547,11 @@ pub fn run(f: *Fetch) RunError!void {...@@ -544,8 +547,11 @@ pub fn run(f: *Fetch) RunError!void {
544 // will already have been resolved to no longer have extra ".." or547 // will already have been resolved to no longer have extra ".." or
545 // "." components.548 // "." components.
546 assert(job_queue.local_storage != null);549 assert(job_queue.local_storage != null);
547 assert(pkg_root.root_dir.eql(f.parent_package_root.root_dir));550 log.debug("checking pkg root \"{s}\" against parent package root \"{s}\"", .{
548 if (!std.mem.startsWith(u8, pkg_root.sub_path, f.parent_package_root.sub_path)) return f.fail(551 pkg_root.sub_path, f.remote_package_root.sub_path,
552 });
553 assert(pkg_root.root_dir.eql(f.remote_package_root.root_dir));
554 if (!std.mem.startsWith(u8, pkg_root.sub_path, f.remote_package_root.sub_path)) return f.fail(
549 f.location_tok,555 f.location_tok,
550 try eb.printString("dependency path outside project: '{f}'", .{pkg_root}),556 try eb.printString("dependency path outside project: '{f}'", .{pkg_root}),
551 );557 );
...@@ -591,6 +597,7 @@ pub fn run(f: *Fetch) RunError!void {...@@ -591,6 +597,7 @@ pub fn run(f: *Fetch) RunError!void {
591 log.debug("using fork {f} for {s}", .{ fork.path, fork.manifest.name });597 log.debug("using fork {f} for {s}", .{ fork.path, fork.manifest.name });
592 fork.uses += 1;598 fork.uses += 1;
593 f.package_root = fork.path;599 f.package_root = fork.path;
600 f.remote_package_root = f.package_root;
594 f.manifest_ast = fork.manifest_ast;601 f.manifest_ast = fork.manifest_ast;
595 f.manifest = fork.manifest;602 f.manifest = fork.manifest;
596 f.have_manifest = true;603 f.have_manifest = true;
...@@ -604,6 +611,7 @@ pub fn run(f: *Fetch) RunError!void {...@@ -604,6 +611,7 @@ pub fn run(f: *Fetch) RunError!void {
604 if (package_root.root_dir.handle.access(io, package_root.sub_path, .{})) |_| {611 if (package_root.root_dir.handle.access(io, package_root.sub_path, .{})) |_| {
605 assert(f.lazy_status != .unavailable);612 assert(f.lazy_status != .unavailable);
606 f.package_root = package_root;613 f.package_root = package_root;
614 f.remote_package_root = f.package_root;
607 try loadManifest(f, f.package_root);615 try loadManifest(f, f.package_root);
608 try checkBuildFileExistence(f);616 try checkBuildFileExistence(f);
609 if (!job_queue.recursive) return;617 if (!job_queue.recursive) return;
...@@ -782,6 +790,7 @@ fn runResource(...@@ -782,6 +790,7 @@ fn runResource(
782 } else {790 } else {
783 f.package_root = tmp_directory_path;791 f.package_root = tmp_directory_path;
784 }792 }
793 f.remote_package_root = f.package_root;
785794
786 if (!disable_recompress) {795 if (!disable_recompress) {
787 // Spin off a task to recompress the tarball, with filtered files deleted, into796 // Spin off a task to recompress the tarball, with filtered files deleted, into
...@@ -993,6 +1002,7 @@ fn queueJobsForDeps(f: *Fetch) RunError!void {...@@ -993,6 +1002,7 @@ fn queueJobsForDeps(f: *Fetch) RunError!void {
993 .all => .eager,1002 .all => .eager,
994 },1003 },
995 .parent_package_root = f.package_root,1004 .parent_package_root = f.package_root,
1005 .remote_package_root = f.remote_package_root,
996 .parent_manifest_ast = &f.manifest_ast,1006 .parent_manifest_ast = &f.manifest_ast,
997 .prog_node = f.prog_node,1007 .prog_node = f.prog_node,
998 .job_queue = f.job_queue,1008 .job_queue = f.job_queue,