ziglang/zig
259
6.0k
Fork
You've already forked zig
771

Package/Fetch: reject path deps that escape the parent package root #31818

Closed
jedisct1 wants to merge 1 commit from jedisct1/zig:escape into master
pull from: jedisct1/zig:escape
merge into: ziglang:master
ziglang:master
ziglang:elfv2
ziglang:spork8
ziglang:restricted
ziglang:0.16.x
ziglang:panic-rewrite
ziglang:parking-futex-lockfree
ziglang:windows-Io-cleanup
ziglang:Io-watch
ziglang:ParseCommandLineOptions
ziglang:windows-async-files
ziglang:poll-ring
ziglang:debug-file-leaks-differently
ziglang:debug-file-leaks
ziglang:ProcessPrng
ziglang:elfv2-dyn
ziglang:jobserver
ziglang:threadtheft
ziglang:io-threaded-no-queue
ziglang:0.15.x
ziglang:Io.net
ziglang:comptime-allocator
ziglang:restricted-function-pointers
ziglang:cli
ziglang:wasm-linker-writer
ziglang:wrangle-writer-buffering
ziglang:sha1-stream
ziglang:async-await-demo
ziglang:fixes
ziglang:0.14.x
ziglang:ast-node-methods
ziglang:macos-debug-info
ziglang:make-vs-configure
ziglang:fuzz-macos
ziglang:sans-aro
ziglang:ArrayList-reserve
ziglang:incr-bug
ziglang:llvm-ir-nosanitize-metadata
ziglang:ci-tarballs
ziglang:ci-scripts
ziglang:threadpool
ziglang:0.12.x
ziglang:new-pkg-hash
ziglang:json-diagnostics
ziglang:more-doctests
ziglang:rework-comptime-mutation
ziglang:0.11.x
ziglang:ci-perf-comment
ziglang:stage2-async
ziglang:0.10.x
ziglang:autofix
ziglang:0.9.x
ziglang:aro
ziglang:hcs
ziglang:0.8.x
ziglang:0.7.x

In spite of what the code comment says, a path dependency declared inside a nested package's build.zig.zon can currently use .. to walk outside the project directory, and zig build is able to happily fetch, compile, and link that external code without any error.

Fixes this:

  • When the parent has a manifest, check directly that the resolved path is within the parent package's sub_path.
  • For a parent at the root of its root_dir, any sub_path that begins with ".." is rejected
  • For deeper parents, a separator must follow the common prefix.
In spite of what the code comment says, a path dependency declared inside a nested package's `build.zig.zon` can currently use `..` to walk outside the project directory, and `zig build` is able to happily fetch, compile, and link that external code without any error. Fixes this: - When the parent has a manifest, check directly that the resolved path is within the parent package's sub_path. - For a parent at the root of its root_dir, any sub_path that begins with ".." is rejected - For deeper parents, a separator must follow the common prefix.
Package/Fetch: reject path deps that escape the parent package root
All checks were successful
ci / x86_64-netbsd-release (pull_request) Successful in 36m48s
ci / x86_64-freebsd-release (pull_request) Successful in 37m41s
ci / x86_64-freebsd-debug (pull_request) Successful in 44m41s
ci / x86_64-netbsd-debug (pull_request) Successful in 47m6s
ci / aarch64-macos-release (pull_request) Successful in 56m12s
ci / aarch64-macos-debug (pull_request) Successful in 1h12m51s
ci / x86_64-linux-debug (pull_request) Successful in 1h13m52s
ci / x86_64-openbsd-release (pull_request) Successful in 1h11m59s
ci / x86_64-openbsd-debug (pull_request) Successful in 1h17m15s
ci / aarch64-linux-release (pull_request) Successful in 1h26m7s
ci / s390x-linux-release (pull_request) Successful in 1h30m23s
ci / x86_64-windows-release (pull_request) Successful in 1h3m39s
ci / x86_64-windows-debug (pull_request) Successful in 1h35m36s
ci / aarch64-linux-debug (pull_request) Successful in 2h28m14s
ci / s390x-linux-debug (pull_request) Successful in 2h33m53s
ci / x86_64-linux-release (pull_request) Successful in 3h3m51s
ci / x86_64-linux-debug-llvm (pull_request) Successful in 3h39m59s
ci / powerpc64le-linux-release (pull_request) Successful in 1h26m50s
ci / powerpc64le-linux-debug (pull_request) Successful in 4h0m14s
ci / loongarch64-linux-release (pull_request) Successful in 2h4m44s
ci / loongarch64-linux-debug (pull_request) Successful in 3h28m57s
ci / riscv64-linux-debug (pull_request) Has been skipped
ci / riscv64-linux-release (pull_request) Has been skipped
ci / aarch64-freebsd-release (pull_request) Successful in 2h50m3s
ci / aarch64-freebsd-debug (pull_request) Successful in 3h59m4s
ci / aarch64-netbsd-debug (pull_request) Successful in 3h52m54s
ci / aarch64-netbsd-release (pull_request) Successful in 2h39m20s
6ceeb6e48e
A path dependency declared inside a nested package's `build.zig.zon`
can use `..` to walk outside the project directory, and `zig build`
was able to happily fetch, compile, and link that external code
without any error.
Fixes this:
- When the parent has a manifest, check directly that the resolved path
is within the parent package's sub_path.
- For a parent at the root of its root_dir, any sub_path that begins
with ".." is rejected
- For deeper parents, a separator must follow the common prefix.
andrewrk added this to the 0.16.0 milestone 2026年04月13日 06:58:40 +02:00
First-time contributor
Copy link

On one hand I can see the importance of not allowing arbitrary code to walk anywhere on your hard drive. It also is a good idea to not encourage a tangled mess of interdependent folders.

On the other hand, when you are working on two interconnected packages inside a Docs folder, and you are experimenting with how to change both of them in a way that you are happy with. Allowing each of them to refer to each other until you are ready to commit each package with a final solution is invaluable.

Is there a compromise for this?

What if the current local project you are building is allowed to use .., but any packages that you pull in remotely are not allowed to use ..?

_On one hand_ I can see the importance of not allowing arbitrary code to walk anywhere on your hard drive. It also is a good idea to not encourage a tangled mess of interdependent folders. _On the other hand_, when you are working on two interconnected packages inside a `Docs` folder, and you are experimenting with how to change both of them in a way that you are happy with. Allowing each of them to refer to each other until you are ready to commit each package with a final solution is invaluable. Is there a compromise for this? What if the current local project you are building is allowed to use `..`, but any packages that you pull in remotely are not allowed to use `..`?
First-time contributor
Copy link

I agree that it's useful to be able to refer to a directory outside the projet, even when working on offline machines that share some packages.
As far as I understood this post new --fork cli flag will still allow this workflow at the cost of manually specifying it.

I agree that it's useful to be able to refer to a directory outside the projet, even when working on offline machines that share some packages. As far as I understood this [post](https://ziglang.org/devlog/2026/#2026年02月06日) new `--fork` cli flag will still allow this workflow at the cost of manually specifying it.
andrewrk removed this from the 0.16.0 milestone 2026年04月13日 18:30:53 +02:00
andrewrk removed their assignment 2026年04月13日 18:30:55 +02:00

related: #31848

related: #31848

Thank you for identifying this problem and making this patch. I agree it's an important issue to resolve. However, given that it is already the case that nested packages must already be trusted by Zig developers when adding a dependency (the nested package's build.zig script is arbitrary code execution after all), I think it's not a release blocker. I'd like to have more time to look carefully at the modified code and reason about it, and in particular maybe try to make it more easily unit testable, or integration testable (#31848).

Thank you for identifying this problem and making this patch. I agree it's an important issue to resolve. However, given that it is already the case that nested packages must already be trusted by Zig developers when adding a dependency (the nested package's `build.zig` script is arbitrary code execution after all), I think it's not a release blocker. I'd like to have more time to look carefully at the modified code and reason about it, and in particular maybe try to make it more easily unit testable, or integration testable (#31848).

Proper fix coming in #31992

Proper fix coming in https://codeberg.org/ziglang/zig/pulls/31992
andrewrk closed this pull request 2026年04月21日 01:47:38 +02:00
All checks were successful
ci / x86_64-netbsd-release (pull_request) Successful in 36m48s
Required
Details
ci / x86_64-freebsd-release (pull_request) Successful in 37m41s
Required
Details
ci / x86_64-freebsd-debug (pull_request) Successful in 44m41s
Required
Details
ci / x86_64-netbsd-debug (pull_request) Successful in 47m6s
Required
Details
ci / aarch64-macos-release (pull_request) Successful in 56m12s
Required
Details
ci / aarch64-macos-debug (pull_request) Successful in 1h12m51s
Required
Details
ci / x86_64-linux-debug (pull_request) Successful in 1h13m52s
Required
Details
ci / x86_64-openbsd-release (pull_request) Successful in 1h11m59s
Required
Details
ci / x86_64-openbsd-debug (pull_request) Successful in 1h17m15s
Required
Details
ci / aarch64-linux-release (pull_request) Successful in 1h26m7s
Required
Details
ci / s390x-linux-release (pull_request) Successful in 1h30m23s
Required
Details
ci / x86_64-windows-release (pull_request) Successful in 1h3m39s
Required
Details
ci / x86_64-windows-debug (pull_request) Successful in 1h35m36s
Required
Details
ci / aarch64-linux-debug (pull_request) Successful in 2h28m14s
Required
Details
ci / s390x-linux-debug (pull_request) Successful in 2h33m53s
Required
Details
ci / x86_64-linux-release (pull_request) Successful in 3h3m51s
Required
Details
ci / x86_64-linux-debug-llvm (pull_request) Successful in 3h39m59s
Required
Details
ci / powerpc64le-linux-release (pull_request) Successful in 1h26m50s
Required
Details
ci / powerpc64le-linux-debug (pull_request) Successful in 4h0m14s
Required
Details
ci / loongarch64-linux-release (pull_request) Successful in 2h4m44s
ci / loongarch64-linux-debug (pull_request) Successful in 3h28m57s
ci / riscv64-linux-debug (pull_request) Has been skipped
ci / riscv64-linux-release (pull_request) Has been skipped
ci / aarch64-freebsd-release (pull_request) Successful in 2h50m3s
ci / aarch64-freebsd-debug (pull_request) Successful in 3h59m4s
ci / aarch64-netbsd-debug (pull_request) Successful in 3h52m54s
ci / aarch64-netbsd-release (pull_request) Successful in 2h39m20s

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
No reviewers
Labels
Clear labels
abi/f32
abi/ilp32
abi/sf
accepted
This proposal is planned.
arch/21k
arch/6502
arch/aarch64
arch/alpha
arch/amdgcn
arch/arc
arch/arc32
arch/arc64
arch/arm
arch/avr
arch/bfin
arch/bpf
arch/colossus
arch/cris
arch/csky
arch/dlx
arch/epiphany
arch/fr30
arch/frv
arch/hexagon
arch/hppa
arch/hppa64
arch/ia64
arch/kalimba
arch/kvx
arch/lanai
arch/lm32
arch/loongarch32
arch/loongarch64
arch/m32r
arch/m68k
arch/m88k
arch/mcore
arch/microblaze
arch/mips
arch/mips64
arch/mmix
arch/moxie
arch/mrisc32
arch/msp430
arch/nds32
arch/ns32k
arch/nvptx
arch/or1k
arch/powerpc
arch/powerpc64
arch/propeller
arch/riscv32
arch/riscv64
arch/rl78
arch/rx
arch/s390x
arch/sh
arch/sparc
arch/sparc64
arch/spirv
arch/spu
arch/tricore
arch/v850
arch/vax
arch/vc4
arch/ve
arch/wasm
arch/x86
arch/x86_64
arch/xcore
arch/xtensa
autodoc
The web application for interactive documentation and generation of its assets.
backend/c
The C backend outputs C source code.
backend/llvm
The LLVM backend outputs an LLVM bitcode module.
backend/self-hosted
The self-hosted backends produce machine code directly.
binutils
Zig's included binary utilities: zig ar, zig dlltool, zig lib, zig ranlib, zig objcopy, and zig rc.
breaking
Implementing this issue could cause existing code to no longer compile or have different behavior.
build system
The Zig build system - zig build, std.Build, the build runner, and package management.
debug info
An issue related to debug information (e.g. DWARF) produced by the Zig compiler.
docs
An issue with documentation, e.g. the language reference or standard library doc comments.
error message
This issue points out an error message that is unhelpful and should be improved.
frontend
Tokenization, parsing, AstGen, ZonGen, Sema, Legalize, and Liveness.
fuzzing
An issue related to Zig's integrated fuzz testing.
incremental
Reuse of internal compiler state for faster compilation.
lib/c
This issue relates to Zig's libc implementation and/or vendored libcs.
lib/compiler-rt
This issue relates to Zig's compiler-rt library.
lib/cxx
This issue relates to Zig's vendored libc++ and/or libc++abi.
lib/std
This issue relates to Zig's standard library.
lib/tsan
This issue relates to Zig's vendored libtsan.
lib/ubsan-rt
This issue relates to Zig's ubsan-rt library.
lib/unwind
This issue relates to Zig's vendored libunwind.
linking
Zig's integrated object file and incremental linker.
miscompilation
The compiler reports success but produces semantically incorrect code.
os/android
os/contiki
os/dragonfly
os/driverkit
os/emscripten
os/freebsd
os/fuchsia
os/haiku
os/hermit
os/hurd
os/illumos
os/ios
os/linux
os/maccatalyst
os/macos
os/managarm
os/netbsd
os/ohos
os/openbsd
os/plan9
os/redox
os/rtems
os/serenity
os/tvos
os/uefi
os/visionos
os/wasi
os/watchos
os/windows
proposal
This issue suggests language modifications. If it also has the "accepted" label then it is planned.
release notes
This issue or pull request should be mentioned in the release notes.
testing
This issue is related to testing the compiler, standard library, or other parts of Zig.
zig cc
Zig as a drop-in C-family compiler.
zig fmt
The Zig source code formatter.
zig reduce
The Zig source code reduction tool.
bounty
https://ziglang.org/news/announcing-donor-bounties
bug
Observed behavior contradicts documented or intended behavior.
contributor-friendly
This issue is limited in scope and/or knowledge of project internals.
downstream
An issue with a third-party project that uses this project.
enhancement
Solving this issue will likely involve adding new logic or components to the codebase.
infra
An issue related to project infrastructure, e.g. continuous integration.
optimization
A task to improve performance and/or resource usage.
question
No questions on the issue tracker; use a community space instead.
regression
Something that used to work in a previous version stopped working
upstream
An issue with a third-party project that this project uses.
use case
Describes a real use case that is difficult or impossible, but does not propose a solution.
No labels
abi/f32
abi/ilp32
abi/sf
accepted
arch/21k
arch/6502
arch/aarch64
arch/alpha
arch/amdgcn
arch/arc
arch/arc32
arch/arc64
arch/arm
arch/avr
arch/bfin
arch/bpf
arch/colossus
arch/cris
arch/csky
arch/dlx
arch/epiphany
arch/fr30
arch/frv
arch/hexagon
arch/hppa
arch/hppa64
arch/ia64
arch/kalimba
arch/kvx
arch/lanai
arch/lm32
arch/loongarch32
arch/loongarch64
arch/m32r
arch/m68k
arch/m88k
arch/mcore
arch/microblaze
arch/mips
arch/mips64
arch/mmix
arch/moxie
arch/mrisc32
arch/msp430
arch/nds32
arch/ns32k
arch/nvptx
arch/or1k
arch/powerpc
arch/powerpc64
arch/propeller
arch/riscv32
arch/riscv64
arch/rl78
arch/rx
arch/s390x
arch/sh
arch/sparc
arch/sparc64
arch/spirv
arch/spu
arch/tricore
arch/v850
arch/vax
arch/vc4
arch/ve
arch/wasm
arch/x86
arch/x86_64
arch/xcore
arch/xtensa
autodoc
backend/c
backend/llvm
backend/self-hosted
binutils
breaking
build system
debug info
docs
error message
frontend
fuzzing
incremental
lib/c
lib/compiler-rt
lib/cxx
lib/std
lib/tsan
lib/ubsan-rt
lib/unwind
linking
miscompilation
os/android
os/contiki
os/dragonfly
os/driverkit
os/emscripten
os/freebsd
os/fuchsia
os/haiku
os/hermit
os/hurd
os/illumos
os/ios
os/linux
os/maccatalyst
os/macos
os/managarm
os/netbsd
os/ohos
os/openbsd
os/plan9
os/redox
os/rtems
os/serenity
os/tvos
os/uefi
os/visionos
os/wasi
os/watchos
os/windows
proposal
release notes
testing
zig cc
zig fmt
zig reduce
bounty
bug
contributor-friendly
downstream
enhancement
infra
optimization
question
regression
upstream
use case
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
4 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
ziglang/zig!31818
Reference in a new issue
ziglang/zig
No description provided.
Delete branch "jedisct1/zig:escape"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?