rust-embed

rust macro which loads files into the rust binary at compile time during release and loads the file from the fs during dev.

47e1f89c — Buckram

Fixed symlinks in debug mode

Files changed (1) hide show

impl/src/lib.rs CHANGED Viewed

@@ -141,7 +141,16 @@ fn dynamic(ident: &syn::Ident, folder_path: String, prefix: Option<&str>, includ
               let canonical_file_path = file_path.canonicalize().ok()?;
               if !canonical_file_path.starts_with(#canonical_folder_path) {
                   // Tried to request a path that is not in the embedded folder
+                  // Should be allowed only if it was a symlink
+                  // TODO: Currently it allows "path_traversal_attack" for the symlink files
+                  // For it to be working properly we need to get absolute path first
+                  // and check that instead if it starts with `canonical_folder_path`
+                  // https://doc.rust-lang.org/std/path/fn.absolute.html (currently nightly)
+                  let metadata = ::std::fs::metadata(file_path.as_path()).ok()?;
+                  if !metadata.is_symlink() {
-                  return ::std::option::Option::None;
+                    return ::std::option::Option::None;
+                  }
               }
               if rust_embed::utils::is_path_included(&rel_file_path, INCLUDES, EXCLUDES) {