nathanwilliams-ct commented on issue #2178: URL: https://github.com/apache/buildstream/issues/2178#issuecomment-5329834567
> What I would suggest here is to disallow `.` and `..` in path names, and not to dereference symlinks when loading the files. > > Ideally, I would move this to use the `Directory` API, which already has some protections around this (even if they might not be enough). I don't think preventing `.` and `..` explicitly is the way to go here, as unlikely as it is, what happens if other path shortcuts are introduced? Uou again end up with this problem. (e.g. zsh supports '...' to go up two levels). We should use the standard library functions/methods to handle this, so it will get maintained properly by the upstream python team, instead of custom implementations that we need to maintain. If the implementations are too slow, lets contribute an optimised implementation to upstream python (as hard as that may be), or ditch python. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
