~sircmpwn/hare#659: 
driver: `hare build` can overwrite source files

Steps to reproduce:

  1. Create a directory called "main.ha".
  2. Create a Hare file "main.ha/main.ha".
  3. In "main.ha/", run hare build.
  4. "main.ha/main.ha" will be overwritten with a created executable.

Go avoids this by checking whether the to-be-overwritten file is an object[1], although this might not work well with +data (#21).

[1] https://github.com/golang/go/blob/ba7f3d98d41f01291dd831e618736b02a79ef27a/src/cmd/go/internal/work/exec.go#L1917

Status
REPORTED
Submitter
~vyivel
Assigned to
No-one
Submitted
1 year, 11 months ago
Updated
11 months ago
Labels
bug driver

~autumnull 11 months ago

imo best way to deal with this is to only overwrite existing files if they're regular files and are executable by the current user.

Register here or Log in to comment, or comment via email.