9389e9f | plum | pyrossh

git clone https://git.pyrossh.dev/plum

A statically typed, imperative programming language inspired by rust, python

9389e9f — Peter John 2026-11-02T14:46:44+05:30

Move sprite generator out of the asset dir, reject symlinks escaping the asset root, discard-target test

Files changed (4) hide show

README.md +1 -1
plum-checker/tests/checker_tests.rs +5 -0
plum-examples/{assets → tools}/make_sprites.py +2 -2
plum-game/src/api.rs +24 -2

README.md CHANGED Viewed

@@ -1029,7 +1029,7 @@ Every module that imports `std/Str` also exports four helpers for hosts that can
 `plum game file.plum` compiles a game and runs it in a native window (macroquad, with the module under wasmtime). `plum game --web file.plum [-o dist] [--assets DIR]` writes a static web build instead: `index.html`, `mq_js_bundle.js`, `plum_bridge.js`, `plum-game.wasm`, `plum.wasm`, `preload.txt` and an `assets/` copy of the whole asset directory (every file in it is listed in `preload.txt` and fetched before the first frame; `dist` defaults to `dist` beside the source file). Serve it from any static host; the browser needs wasm GC support. The web build needs `rustup target add wasm32-unknown-unknown`.
-`plum game plum-examples/game.plum` runs the example, a small arcade game: steer a ship with the arrow keys or WASD, collect orbs, dodge mines (Enter restarts). It draws shapes, text and an animated sprite sheet (`plum-examples/assets/sprites.png`, generated by `make_sprites.py` beside it). Its rules are plain functions with `test` blocks, so `plum test plum-examples` covers them without a window.
+`plum game plum-examples/game.plum` runs the example, a small arcade game: steer a ship with the arrow keys or WASD, collect orbs, dodge mines (Enter restarts). It draws shapes, text and an animated sprite sheet (`plum-examples/assets/sprites.png`, generated by `plum-examples/tools/make_sprites.py`, kept outside the asset dir so it is not shipped). Its rules are plain functions with `test` blocks, so `plum test plum-examples` covers them without a window.
 ![the example game](docs/game.png)

plum-checker/tests/checker_tests.rs CHANGED Viewed

@@ -919,3 +919,8 @@ fn underscoreDiscardIsAccepted() {
     );
     assert!(r.is_ok(), "{:?}", r.err());
 }
+#[test]
+fn discardTargetTwiceInOneScopeIsFine() {
+    assert!(checkDiscard("fun f() =\n  _ := five()\n  _ := five()\n  _ = five()\n  _ := five()\n").is_ok());
+}

plum-examples/{assets → tools}/make_sprites.py RENAMED Viewed

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Writes sprites.png beside this script: a 64x48 sheet of 16x16 frames.
+"""Writes ../assets/sprites.png: a 64x48 sheet of 16x16 frames.
 Row 0: the ship with four engine-flame frames (pointing up).
 Row 1: an orb spinning (four frames, squeezed and widened).
@@ -81,5 +81,5 @@ png = b"\x89PNG\r\n\x1a\n"
 png += chunk(b"IHDR", struct.pack(">IIBBBBB", W, H, 8, 6, 0, 0, 0))
 png += chunk(b"IDAT", zlib.compress(raw, 9))
 png += chunk(b"IEND", b"")
-with open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "sprites.png"), "wb") as f:
+with open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "..", "assets", "sprites.png"), "wb") as f:
     f.write(png)

plum-game/src/api.rs CHANGED Viewed

@@ -61,6 +61,12 @@ pub fn path_in_root(path: &str) -> bool {
         && Path::new(path).components().all(|c| matches!(c, Component::Normal(_) | Component::CurDir))
 }
+/// `root/path` when it still resolves inside `root` after following symlinks.
+fn contained(root: &Path, path: &str) -> Option<PathBuf> {
+    let full = std::fs::canonicalize(root.join(path)).ok()?;
+    full.starts_with(std::fs::canonicalize(root).ok()?).then_some(full)
+}
 /// Where an [`AssetStore`] reads its files from.
 enum Source {
     /// Files under a directory (native).
@@ -105,7 +111,7 @@ impl AssetStore {
             return None;
         }
         match &self.source {
-            Source::Dir(root) => std::fs::read(root.join(path)).ok(),
+            Source::Dir(root) => std::fs::read(contained(root, path)?).ok(),
             Source::Files(files) => files.get(path.trim_start_matches("./")).cloned(),
         }
     }
@@ -115,7 +121,7 @@ impl AssetStore {
             return false;
         }
         match &self.source {
-            Source::Dir(root) => root.join(path).is_file(),
+            Source::Dir(root) => contained(root, path).is_some_and(|p| p.is_file()),
             Source::Files(files) => files.contains_key(path.trim_start_matches("./")),
         }
     }
@@ -184,6 +190,22 @@ mod tests {
         assert_eq!(s.file_load("a.txt"), b"hi");
     }
+    #[cfg(unix)]
+    #[test]
+    fn symlinks_out_of_the_root_are_rejected() {
+        let base = std::env::temp_dir().join(format!("plum_symlink_{}", std::process::id()));
+        let root = base.join("root");
+        std::fs::create_dir_all(&root).unwrap();
+        std::fs::write(base.join("secret.txt"), b"s").unwrap();
+        std::fs::write(root.join("ok.txt"), b"o").unwrap();
+        std::os::unix::fs::symlink(base.join("secret.txt"), root.join("link.txt")).unwrap();
+        let s = AssetStore::new(root);
+        assert!(s.file_exists("ok.txt"));
+        assert!(!s.file_exists("link.txt"));
+        assert!(s.file_load("link.txt").is_empty());
+        let _ = std::fs::remove_dir_all(&base);
+    }
     #[test]
     fn paths_escaping_the_root_are_rejected() {
         for bad in ["../x", "a/../../x", "/etc/passwd", "a\\b", ""] {