-
Notifications
You must be signed in to change notification settings - Fork 288
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
cue/interpreter/embed: embed should not follow symbolic links #3299
Comments
Noting the "conclusion" I proposed in #3300 (comment), I still remain of the opinion that |
See the comment here: #3300 (comment) Also, it's not currently trivial to add symlink checks in embed as it uses |
Valid symbolic links are currently allowed, but that will change in the next commit. This test allows us to see the change in behavior. While here, add more error test cases for embedding as well. In particular, the "cannot embed directories" and invalid filetype error code paths were not covered in the tests. For #3299. Signed-off-by: Daniel Martí <mvdan@mvdan.cc> Change-Id: I5f80b1dc81e2a2bd13bd084be74cabec6f205ba4 Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1199032 Unity-Result: CUE porcuepine <cue.porcuepine@gmail.com> TryBot-Result: CUEcueckoo <cueckoo@cuelang.org> Reviewed-by: Roger Peppe <rogpeppe@gmail.com>
We have gone back and forth on this in offline discussions, so I'll try to summarize the current state:
We have added test cases for embedding symlinks in https://review.gerrithub.io/c/cue-lang/cue/+/1199032 and https://review.gerrithub.io/c/cue-lang/cue/+/1199041, which capture the current behavior. Those are merged for rc.1. For the reasons above, https://review.gerrithub.io/c/cue-lang/cue/+/1199041 will not be merged for rc.1. Particularly, it fails on point 3 - it does not forbid Assuming that #3300 converges on "we must support symlinks when loading packages and when embedding files for good Bazel compatibility" in the coming days, I'd be fine with shipping v0.10.0 with that implementation. |
This is different than embedding a symlink itself, as we follow a symlink as part of traversing a directory to open a regular file or match a glob resulting in regular files. For #3299. Signed-off-by: Daniel Martí <mvdan@mvdan.cc> Change-Id: I1c02a64a442b2a1c29192a29171b0ad6a903b43e Reviewed-on: https://review.gerrithub.io/c/cue-lang/cue/+/1199041 Reviewed-by: Roger Peppe <rogpeppe@gmail.com> TryBot-Result: CUEcueckoo <cueckoo@cuelang.org> Unity-Result: CUE porcuepine <cue.porcuepine@gmail.com>
What version of CUE are you using (
cue version
)?Does this issue reproduce with the latest release?
Yes
What did you do?
What did you expect to see?
Passing test (for some variation of the error message)
What did you see instead?
The text was updated successfully, but these errors were encountered: