bazel-contrib / bazel-contrib/rules_foreign_cc
Calls to `rm -rf` and `mkdir` are improperly quoted
- Dominant language
- Starlark
- Stars
- 737
- Forks
- 270
- PR merge metrics
- No merged PRs in 30d
Description
Calls to `rm -rf` and `mkdir`, such as in `rm -rf $BUILD_TMPDIR` and `mkdir -p $INSTALLDIR` are not properly quoted and therefore do not handle paths containing spaces. I would go so far as to consider this a security issue, as the generated script may end up force-deleting any directory on a user's system for which it has permission to do so.
This issue is most apparent on Windows systems, where paths containing spaces are commonplace.
Contributor guide
Research direction
Start by searching the rules_foreign_cc sources for generation of the `rm -rf` and `mkdir -p` commands shown in the issue. Reproduce the generated script with paths containing spaces, especially on Windows, and verify that those commands preserve each path as a single argument without enabling unintended deletion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 43/100