bazel-contrib / bazel-contrib/rules_ruby

require_relative should never be used with bazel because it reads files from the source tree instead of the sandbox runfiles tree

Open
#225 8 comments 0 reactions 0 assignees View on GitHub
Dominant language
Starlark
Stars
50
Forks
22
Avg merge
9d 23h
Merged PRs (30d)
5

Description

I've discovered that the use of `require_relative` vs `require` actually reads files from the source tree instead of the files in the bazel sandbox runfiles tree.

Repro: https://github.com/bazel-contrib/rules_ruby/pull/224/files

In this example, you can remove the `:spec_helper` library from the `:add` test target and it will still pass even though spec_helper.rb doesnt exist in any of the runfiles. This is because require_relative loads the file directly from the source tree (your local repo) and bypasses Bazel sandbox.

If you change `require_relative` to `require`, it will fail to find the spec_helper.rb file until you add back `:spec_helper` as a dependency.

require always searches files from $LOAD_PATH, and in bazel rules_ruby, the deps, srcs, and bundle repo gems are always on in the list of dirs in $LOAD_PATH.

I think it might be good to add a require_relative static analysis check in `rb_library` to fail any rb file that has this function used in rules_ruby to avoid this silent/unintentional behavior. The result is that your bazel targets may be unknowingly using files that are not declared as dependencies. Thoughts?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.