Keep imported file reads bound to the validated module root

オープン
  • 何か問題がありますか？
#1,059 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
rust
領域
compilers, security

調査の方向性

Start with the containment checks in front/parser/src/import.rs: local_import_unit_with_config, external_import_unit, and resolve_std_import_path; then inspect the second canonicalization and read_to_string in parse_wave_file. Discuss the portable identity and symlink policy with @LunaStev before implementation. Done means controlled replacement cannot load an out-of-root file for any import class, with regression coverage for in-root and fixed out-of-root symlinks and normal source diagnostics.

索引モデルが issue の本文から書いたものです。

説明

bug discussion

Problem

wavec check can parse an imported file outside its declared root if the selected file is replaced while import resolution is in progress. A fixed external symlink is correctly rejected, but the path is canonicalized for containment and then canonicalized/read again. A concurrent rename can change the object between those operations.

This violates the documented local-module, dependency-package, and std-root import boundaries. It is a reproducible compiler correctness bug; this report does not assert that it crosses a privilege or confidentiality boundary. The existing #644 and #931 cover static import containment and the deliberate ../ policy, respectively.

The same check/read gap is present on canonical master 933ec43820f96eea66708eeb9932dc0a49893301: see the containment checks in front/parser/src/import.rs (local_import_unit_with_config, external_import_unit, and resolve_std_import_path) and the later second canonicalization and read_to_string in parse_wave_file. The tested branch revision was ceb8f7a05480e2bdfcf7650648eb96257f3a1d33; its source-snapshot change retains this gap.

Reproduction

Tested on Linux x86_64 with target/debug/wavec 0.0.1-alpha-dev (LLVM 21.1.8). This uses only temporary fixtures; it does not modify the repository. From the Wave checkout, run:

python3 - <<'PY'
import ctypes
import os
from pathlib import Path
import subprocess
import tempfile
import threading

wavec = str(Path('target/debug/wavec').resolve())
libc = ctypes.CDLL(None, use_errno=True)
exchange = libc.renameat2
exchange.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
exchange.restype = ctypes.c_int

with tempfile.TemporaryDirectory() as temporary:
    root = Path(temporary)
    project = root / 'project'
    project.mkdir()
    outside = root / 'outside.wave'
    outside.write_text('pub fun outside_only() -> i32 { return 2; }\n')
    target = project / 'helper.wave'
    target.write_text('pub fun inside_only() -> i32 { return 1; }\n')
    alternate = project / 'alternate'
    alternate.symlink_to(outside)
    main = project / 'main.wave'
    main.write_text('import("./helper")::{outside_only};\n'
                    'fun main() { var n: i32 = outside_only(); }\n')

    baseline = subprocess.run([wavec, 'check', str(main)], capture_output=True)
    assert baseline.returncode != 0  # Inside helper has no outside_only.

    stop = threading.Event()
    def swap():
        while not stop.is_set():
            if exchange(-100, os.fsencode(target), -100, os.fsencode(alternate), 2):
                raise OSError(ctypes.get_errno(), 'renameat2')
    worker = threading.Thread(target=swap, daemon=True)
    worker.start()
    accepted = 0
    for _ in range(150):
        result = subprocess.run([wavec, 'check', str(main)], capture_output=True)
        accepted += result.returncode == 0
    stop.set()
    worker.join()
    print(f'outside module accepted: {accepted}/150')
PY

On this host, the local-import run accepted the outside-only symbol 61/150 times. The same atomic-swap fixture applied to an explicit --dep pkg=<root> package entry accepted it 33/100 times and to an explicit --std-root <root> module accepted it 42/100 times. Without the concurrent swap, fixed outside symlinks and ./../ paths were rejected in all three import classes. Counts are scheduling-dependent; any successful check for outside_only demonstrates the wrong file was parsed.

Scope

Keep the current static path rules and valid in-root imports, including existing in-root symlink behavior. Ensure the object actually read is the one validated against the appropriate root, or reject the import if that identity cannot be maintained. The portable approach and symlink policy need design discussion before implementation. Please mention @LunaStev to discuss the design before starting implementation.

Completion criteria

  • Concurrent replacement cannot cause local, dependency, or std import to parse an out-of-root file.
  • Regression coverage includes a controlled replacement between validation and read, plus ordinary in-root and fixed out-of-root symlink cases.
  • Failure is a normal source diagnostic; no outside file content is used for compilation or diagnostics.
主要言語
Rust
スター
56
フォーク
21
平均マージ
23時間 20分
マージ済み PR（30日）
45

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

wavefnd/Wave のほかの issue

wavefnd/Wave の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。