Keep imported file reads bound to the validated module root

Đang mở
  • Có gì không ổn?
#1,059 0 bình luận 0 reaction 0 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

Chưa có ai nhận issue này.

Đánh giá

Độ khó
5/5
Thời gian dự kiến
Hơn một tuần
Mức phù hợp với người mới
35/100
Loại issue
Lỗi
Độ rõ ràng
Đặc tả rõ ràng
Mức độ hoạt động
Sôi nổi
Công nghệ
rust
Lĩnh vực
compilers, security

Hướng nghiên cứu

Start with the containment checks in front/parser/src/import.rs: local_import_unit_with_config, external_import_unit, and resolve_std_import_path; then inspect the second canonicalization and read_to_string in parse_wave_file. Discuss the portable identity and symlink policy with @LunaStev before implementation. Done means controlled replacement cannot load an out-of-root file for any import class, with regression coverage for in-root and fixed out-of-root symlinks and normal source diagnostics.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.

Mô tả

bug discussion

Problem

wavec check can parse an imported file outside its declared root if the selected file is replaced while import resolution is in progress. A fixed external symlink is correctly rejected, but the path is canonicalized for containment and then canonicalized/read again. A concurrent rename can change the object between those operations.

This violates the documented local-module, dependency-package, and std-root import boundaries. It is a reproducible compiler correctness bug; this report does not assert that it crosses a privilege or confidentiality boundary. The existing #644 and #931 cover static import containment and the deliberate ../ policy, respectively.

The same check/read gap is present on canonical master 933ec43820f96eea66708eeb9932dc0a49893301: see the containment checks in front/parser/src/import.rs (local_import_unit_with_config, external_import_unit, and resolve_std_import_path) and the later second canonicalization and read_to_string in parse_wave_file. The tested branch revision was ceb8f7a05480e2bdfcf7650648eb96257f3a1d33; its source-snapshot change retains this gap.

Reproduction

Tested on Linux x86_64 with target/debug/wavec 0.0.1-alpha-dev (LLVM 21.1.8). This uses only temporary fixtures; it does not modify the repository. From the Wave checkout, run:

python3 - <<'PY'
import ctypes
import os
from pathlib import Path
import subprocess
import tempfile
import threading

wavec = str(Path('target/debug/wavec').resolve())
libc = ctypes.CDLL(None, use_errno=True)
exchange = libc.renameat2
exchange.argtypes = [ctypes.c_int, ctypes.c_char_p, ctypes.c_int, ctypes.c_char_p, ctypes.c_uint]
exchange.restype = ctypes.c_int

with tempfile.TemporaryDirectory() as temporary:
    root = Path(temporary)
    project = root / 'project'
    project.mkdir()
    outside = root / 'outside.wave'
    outside.write_text('pub fun outside_only() -> i32 { return 2; }\n')
    target = project / 'helper.wave'
    target.write_text('pub fun inside_only() -> i32 { return 1; }\n')
    alternate = project / 'alternate'
    alternate.symlink_to(outside)
    main = project / 'main.wave'
    main.write_text('import("./helper")::{outside_only};\n'
                    'fun main() { var n: i32 = outside_only(); }\n')

    baseline = subprocess.run([wavec, 'check', str(main)], capture_output=True)
    assert baseline.returncode != 0  # Inside helper has no outside_only.

    stop = threading.Event()
    def swap():
        while not stop.is_set():
            if exchange(-100, os.fsencode(target), -100, os.fsencode(alternate), 2):
                raise OSError(ctypes.get_errno(), 'renameat2')
    worker = threading.Thread(target=swap, daemon=True)
    worker.start()
    accepted = 0
    for _ in range(150):
        result = subprocess.run([wavec, 'check', str(main)], capture_output=True)
        accepted += result.returncode == 0
    stop.set()
    worker.join()
    print(f'outside module accepted: {accepted}/150')
PY

On this host, the local-import run accepted the outside-only symbol 61/150 times. The same atomic-swap fixture applied to an explicit --dep pkg=<root> package entry accepted it 33/100 times and to an explicit --std-root <root> module accepted it 42/100 times. Without the concurrent swap, fixed outside symlinks and ./../ paths were rejected in all three import classes. Counts are scheduling-dependent; any successful check for outside_only demonstrates the wrong file was parsed.

Scope

Keep the current static path rules and valid in-root imports, including existing in-root symlink behavior. Ensure the object actually read is the one validated against the appropriate root, or reject the import if that identity cannot be maintained. The portable approach and symlink policy need design discussion before implementation. Please mention @LunaStev to discuss the design before starting implementation.

Completion criteria

  • Concurrent replacement cannot cause local, dependency, or std import to parse an out-of-root file.
  • Regression coverage includes a controlled replacement between validation and read, plus ordinary in-root and fixed out-of-root symlink cases.
  • Failure is a normal source diagnostic; no outside file content is used for compilation or diagnostics.
Ngôn ngữ chính
Rust
Star
56
Fork
21
Merge trung bình
23 giờ 20 phút
Pull request đã merge (30 ngày)
45

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của wavefnd/Wave

Tất cả issue của wavefnd/Wave

Issue tương tự

Thêm issue về Rust

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.