rust-lang / rust-lang/rust

`with_file_name` doesn't provide checks for "path filenames"

Open
#122,868 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

A-io T-libs
Dominant language
Rust
Stars
119k
Forks
16.1k
PR merge metrics
PR metrics pending

Description

Filenames which include paths are not being treated properly by with_file_name in the Path library. Filenames which include ".." and other similar components are treated as part of the path. For example, consider:

use std::fs::File;
use std::path::Path;

fn main() {
    let pathtest = "test/hey.txt";
    let name = r"../gotu.txt";
    let path = Path::new(pathtest);
    let actual_path = path.with_file_name(name);

    File::create(actual_path).unwrap();
}

It will create "gotu.txt" at the parent directory, which could lead to potential security issues (creating files at unintended directories).

Solutions

Change the current behavior

Changing the implementation which will includes checks for this kind of behavior. (A very easy fix.)

Change the documentation

Include an example, a fix or a warning about this behavior in the documentation.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the Path::with_file_name entry point, its implementation, and its existing documentation. Determine whether the project wants changed path handling or an explicit warning/example, then identify the relevant test location and define done as covering the reported path-filename behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.