From a666a4af224a513fd0a48cd9d113edbdba911c94 Mon Sep 17 00:00:00 2001 From: Cody P Schafer Date: Wed, 1 Feb 2023 21:05:18 -0500 Subject: [PATCH] If a file path references a parent directory, transform it to ensure we keep inside the OUT_DIR Otherwise, source file paths like `../../../../foo.c` can result in writing `$CARGO_TARGET_DIR/foo.o`. This is a slightly more aggressive application of object path re-writing than strictly needed to ensure we don't have `OUT_DIR` escapes, but it should be perfectly effective. --- src/lib.rs | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/lib.rs b/src/lib.rs index 66f917b86..499921767 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -1037,9 +1037,10 @@ impl Build { let mut objects = Vec::new(); for file in self.files.iter() { - let obj = if file.has_root() { - // If `file` is an absolute path, prefix the `basename` - // with the `dirname`'s hash to ensure name uniqueness. + let obj = if file.has_root() || file.components().any(|x| x == Component::ParentDir) { + // If `file` is an absolute path or might not be usable directly as a suffix due to + // using "..", use the `basename` prefixed with the `dirname`'s hash to ensure name + // uniqueness. let basename = file .file_name() .ok_or_else(|| Error::new(ErrorKind::InvalidArgument, "file_name() failure"))?