Keep imported file reads bound to the validated module root

Aperta
  • Qualcosa non va?
#1,059 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
compilers, security

Direzione di ricerca

Start with the containment checks in front/parser/src/import.rs: local_import_unit_with_config, external_import_unit, and resolve_std_import_path; then inspect the second canonicalization and read_to_string in parse_wave_file. Discuss the portable identity and symlink policy with @LunaStev before implementation. Done means controlled replacement cannot load an out-of-root file for any import class, with regression coverage for in-root and fixed out-of-root symlinks and normal source diagnostics.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug discussion

Problem

wavec check can parse an imported file outside its declared root if the selected file is replaced while import resolution is in progress. A fixed external symlink is correctly rejected, but the path is canonicalized for containment and then canonicalized/read again. A concurrent rename can change the object between those operations.

This violates the documented local-module, dependency-package, and std-root import boundaries. It is a reproducible compiler correctness bug; this report does not assert that it crosses a privilege or confidentiality boundary. The existing #644 and #931 cover static import containment and the deliberate ../ policy, respectively.

The same check/read gap is present on canonical master 933ec43820f96eea66708eeb9932dc0a49893301: see the containment checks in front/parser/src/import.rs (local_import_unit_with_config, external_import_unit, and resolve_std_import_path) and the later second canonicalization and read_to_string in parse_wave_file. The tested branch revision was ceb8f7a05480e2bdfcf7650648eb96257f3a1d33; its source-snapshot change retains this gap.

Reproduction

Tested on Linux x86_64 with target/debug/wavec 0.0.1-alpha-dev (LLVM 21.1.8). This uses only temporary fixtures; it does not modify the repository. From the Wave checkout, run:

python3 - <<'PY'
import ctypes
import os
from pathlib import Path
import subprocess
import tempfile
import threading

wavec = str(Path('target/debug/wavec').resolve())
libc = ctypes.CDLL(None, use_errno=True)
exchange = libc.renameat2
exchange.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
exchange.restype = ctypes.c_int

with tempfile.TemporaryDirectory() as temporary:
    root = Path(temporary)
    project = root / 'project'
    project.mkdir()
    outside = root / 'outside.wave'
    outside.write_text('pub fun outside_only() -> i32 { return 2; }\n')
    target = project / 'helper.wave'
    target.write_text('pub fun inside_only() -> i32 { return 1; }\n')
    alternate = project / 'alternate'
    alternate.symlink_to(outside)
    main = project / 'main.wave'
    main.write_text('import("./helper")::{outside_only};\n'
                    'fun main() { var n: i32 = outside_only(); }\n')

    baseline = subprocess.run([wavec, 'check', str(main)], capture_output=True)
    assert baseline.returncode != 0  # Inside helper has no outside_only.

    stop = threading.Event()
    def swap():
        while not stop.is_set():
            if exchange(-100, os.fsencode(target), -100, os.fsencode(alternate), 2):
                raise OSError(ctypes.get_errno(), 'renameat2')
    worker = threading.Thread(target=swap, daemon=True)
    worker.start()
    accepted = 0
    for _ in range(150):
        result = subprocess.run([wavec, 'check', str(main)], capture_output=True)
        accepted += result.returncode == 0
    stop.set()
    worker.join()
    print(f'outside module accepted: {accepted}/150')
PY

On this host, the local-import run accepted the outside-only symbol 61/150 times. The same atomic-swap fixture applied to an explicit --dep pkg=<root> package entry accepted it 33/100 times and to an explicit --std-root <root> module accepted it 42/100 times. Without the concurrent swap, fixed outside symlinks and ./../ paths were rejected in all three import classes. Counts are scheduling-dependent; any successful check for outside_only demonstrates the wrong file was parsed.

Scope

Keep the current static path rules and valid in-root imports, including existing in-root symlink behavior. Ensure the object actually read is the one validated against the appropriate root, or reject the import if that identity cannot be maintained. The portable approach and symlink policy need design discussion before implementation. Please mention @LunaStev to discuss the design before starting implementation.

Completion criteria

  • Concurrent replacement cannot cause local, dependency, or std import to parse an out-of-root file.
  • Regression coverage includes a controlled replacement between validation and read, plus ordinary in-root and fixed out-of-root symlink cases.
  • Failure is a normal source diagnostic; no outside file content is used for compilation or diagnostics.
Lingua principale
Rust
Stelle
56
Fork
21
Merge medio
23h 20m
PR unite (30g)
45

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di wavefnd/Wave

Tutte le issue di wavefnd/Wave

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.