Keep imported file reads bound to the validated module root

Abierto
  • ¿Algo no está bien?
#1,059 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
5/5
Tiempo estimado
Más de una semana
Aptitud para principiantes
35/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
rust
Área
compilers, security

Línea de trabajo

Start with the containment checks in front/parser/src/import.rs: local_import_unit_with_config, external_import_unit, and resolve_std_import_path; then inspect the second canonicalization and read_to_string in parse_wave_file. Discuss the portable identity and symlink policy with @LunaStev before implementation. Done means controlled replacement cannot load an out-of-root file for any import class, with regression coverage for in-root and fixed out-of-root symlinks and normal source diagnostics.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug discussion

Problem

wavec check can parse an imported file outside its declared root if the selected file is replaced while import resolution is in progress. A fixed external symlink is correctly rejected, but the path is canonicalized for containment and then canonicalized/read again. A concurrent rename can change the object between those operations.

This violates the documented local-module, dependency-package, and std-root import boundaries. It is a reproducible compiler correctness bug; this report does not assert that it crosses a privilege or confidentiality boundary. The existing #644 and #931 cover static import containment and the deliberate ../ policy, respectively.

The same check/read gap is present on canonical master 933ec43820f96eea66708eeb9932dc0a49893301: see the containment checks in front/parser/src/import.rs (local_import_unit_with_config, external_import_unit, and resolve_std_import_path) and the later second canonicalization and read_to_string in parse_wave_file. The tested branch revision was ceb8f7a05480e2bdfcf7650648eb96257f3a1d33; its source-snapshot change retains this gap.

Reproduction

Tested on Linux x86_64 with target/debug/wavec 0.0.1-alpha-dev (LLVM 21.1.8). This uses only temporary fixtures; it does not modify the repository. From the Wave checkout, run:

python3 - <<'PY'
import ctypes
import os
from pathlib import Path
import subprocess
import tempfile
import threading

wavec = str(Path('target/debug/wavec').resolve())
libc = ctypes.CDLL(None, use_errno=True)
exchange = libc.renameat2
exchange.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
exchange.restype = ctypes.c_int

with tempfile.TemporaryDirectory() as temporary:
    root = Path(temporary)
    project = root / 'project'
    project.mkdir()
    outside = root / 'outside.wave'
    outside.write_text('pub fun outside_only() -> i32 { return 2; }\n')
    target = project / 'helper.wave'
    target.write_text('pub fun inside_only() -> i32 { return 1; }\n')
    alternate = project / 'alternate'
    alternate.symlink_to(outside)
    main = project / 'main.wave'
    main.write_text('import("./helper")::{outside_only};\n'
                    'fun main() { var n: i32 = outside_only(); }\n')

    baseline = subprocess.run([wavec, 'check', str(main)], capture_output=True)
    assert baseline.returncode != 0  # Inside helper has no outside_only.

    stop = threading.Event()
    def swap():
        while not stop.is_set():
            if exchange(-100, os.fsencode(target), -100, os.fsencode(alternate), 2):
                raise OSError(ctypes.get_errno(), 'renameat2')
    worker = threading.Thread(target=swap, daemon=True)
    worker.start()
    accepted = 0
    for _ in range(150):
        result = subprocess.run([wavec, 'check', str(main)], capture_output=True)
        accepted += result.returncode == 0
    stop.set()
    worker.join()
    print(f'outside module accepted: {accepted}/150')
PY

On this host, the local-import run accepted the outside-only symbol 61/150 times. The same atomic-swap fixture applied to an explicit --dep pkg=<root> package entry accepted it 33/100 times and to an explicit --std-root <root> module accepted it 42/100 times. Without the concurrent swap, fixed outside symlinks and ./../ paths were rejected in all three import classes. Counts are scheduling-dependent; any successful check for outside_only demonstrates the wrong file was parsed.

Scope

Keep the current static path rules and valid in-root imports, including existing in-root symlink behavior. Ensure the object actually read is the one validated against the appropriate root, or reject the import if that identity cannot be maintained. The portable approach and symlink policy need design discussion before implementation. Please mention @LunaStev to discuss the design before starting implementation.

Completion criteria

  • Concurrent replacement cannot cause local, dependency, or std import to parse an out-of-root file.
  • Regression coverage includes a controlled replacement between validation and read, plus ordinary in-root and fixed out-of-root symlink cases.
  • Failure is a normal source diagnostic; no outside file content is used for compilation or diagnostics.
Lenguaje dominante
Rust
Estrellas
56
Forks
21
Merge medio
23 h 20 min
PR fusionados (30 d)
45

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de wavefnd/Wave

Todos los issues de wavefnd/Wave

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.