bazel-contrib / bazel-contrib/rules_foreign_cc

Calls to `rm -rf` and `mkdir` are improperly quoted

Open
#1,388 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Starlark
Stars
737
Forks
270
PR merge metrics
No merged PRs in 30d

Description

Calls to `rm -rf` and `mkdir`, such as in `rm -rf $BUILD_TMPDIR` and `mkdir -p $INSTALLDIR` are not properly quoted and therefore do not handle paths containing spaces. I would go so far as to consider this a security issue, as the generated script may end up force-deleting any directory on a user's system for which it has permission to do so.

This issue is most apparent on Windows systems, where paths containing spaces are commonplace.

Contributor guide

Open the contributing guide

Research direction

Start by searching the rules_foreign_cc sources for generation of the `rm -rf` and `mkdir -p` commands shown in the issue. Reproduce the generated script with paths containing spaces, especially on Windows, and verify that those commands preserve each path as a single argument without enabling unintended deletion.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
build-system
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
43/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.