`with_file_name` doesn't provide checks for "path filenames"
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 119k
- Forks
- 16.1k
- PR merge metrics
- PR metrics pending
Description
Filenames which include paths are not being treated properly by with_file_name in the Path library. Filenames which include ".." and other similar components are treated as part of the path. For example, consider:
use std::fs::File;
use std::path::Path;
fn main() {
let pathtest = "test/hey.txt";
let name = r"../gotu.txt";
let path = Path::new(pathtest);
let actual_path = path.with_file_name(name);
File::create(actual_path).unwrap();
}
It will create "gotu.txt" at the parent directory, which could lead to potential security issues (creating files at unintended directories).
Solutions
Change the current behavior
Changing the implementation which will includes checks for this kind of behavior. (A very easy fix.)
Change the documentation
Include an example, a fix or a warning about this behavior in the documentation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the Path::with_file_name entry point, its implementation, and its existing documentation. Determine whether the project wants changed path handling or an explicit warning/example, then identify the relevant test location and define done as covering the reported path-filename behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100