aidanmct commented on issue #2178: URL: https://github.com/apache/buildstream/issues/2178#issuecomment-5330144619
> I don't think preventing . and .. explicitly is the way to go here, as unlikely as it is, what happens if other path shortcuts are introduced? You again end up with this problem. (e.g. zsh supports '...' to go up two levels). That's massively overthinking it; path resolution is handled by the kernel, not the shell. And even if I don't like it, `...` is a valid filename. Personally I don't see anything wrong with relative paths or symlinks in projects. Even if they are pointless, why add code to forbid them if it isn't causing any harm? The only question for me is junctions... If they aren't sandboxed and can escape their project by pointing to arbitrary files on the host filesystem using relative paths or symlinks then that is fairly bad, given bst can download projects from the internet automatically without verification (a git repo, one of the most common ways to use junctions, provides no defense against tampering). And this goes for all ways that a project can direct bst to access files. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
