From f08aabfb77753dd7b97d3e90c0d764f3f6332dfb Mon Sep 17 00:00:00 2001 From: Eli Schwartz Date: Sat, 12 Feb 2022 22:55:46 -0500 Subject: [PATCH] validate the literal directory "subprojects" when checking sandbox violations We do not want anyone touching this entire directory tree, but due to the way it was implemented, we only checked if its direct parent was a subproject violation. This generally worked, unless people tried to add `subprojects/` as an include directory. Patch this hole. It now provides the same warning any sandbox violation does (but is not currently an error, just a "will become an error in the future"). --- mesonbuild/interpreter/interpreter.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mesonbuild/interpreter/interpreter.py b/mesonbuild/interpreter/interpreter.py index d803fdb02..12abdf0c2 100644 --- a/mesonbuild/interpreter/interpreter.py +++ b/mesonbuild/interpreter/interpreter.py @@ -2681,11 +2681,12 @@ Try setting b_lundef to false instead.'''.format(self.coredata.options[OptionKey # /opt/vendorsdk/src/file_with_license_restrictions.c return project_root = Path(srcdir, self.root_subdir) + subproject_dir = project_root / self.subproject_dir if norm == project_root: return if project_root not in norm.parents: raise InterpreterException(f'Sandbox violation: Tried to grab {inputtype} {norm.name} outside current (sub)project.') - if project_root / self.subproject_dir in norm.parents: + if subproject_dir == norm or subproject_dir in norm.parents: raise InterpreterException(f'Sandbox violation: Tried to grab {inputtype} {norm.name} from a nested subproject.') @T.overload