+7 -2

CHANGELOG.md

View file Reviewed

··· 517 517 ([evipepota](https://github.com/evipepota) and 518 518 ([Louis Pilfold](https://github.com/lpil)) 519 519 520 520 + - Stricter deserialisation rules for files internal the build directory to 521 521 + reject corrupted data. 522 522 + ([Abdelrahman Ahmed Aboelkasem](https://github.com/0x2face), 523 523 + ([Aly](https://github.com/spect3r1), and 524 524 + ([Louis Pilfold](https://github.com/lpil)) 525 525 + 520 526 - Restrict publication tarball creation so they cannot contain files from 521 527 outside the project root. 522 528 ([Abdelrahman Ahmed Aboelkasem](https://github.com/0x2face), 523 523 - ([Aly](https://github.com/spect3r1), and 524 524 - ([Louis Pilfold](https://github.com/lpil)) 529 529 + ([Aly](https://github.com/spect3r1), and ([Louis Pilfold](https://github.com/lpil))

+36 -4

compiler-cli/src/dependencies.rs

View file Reviewed

··· 571 571 // the `project/build/packages` directory. 572 572 // For descriptions of packages provided by paths and git deps, see the ProvidedPackage struct. 573 573 // The same package may appear in both at different times. 574 574 - #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)] 574 574 + #[derive(Debug, Clone, serde::Serialize, serde::Deserialize, PartialEq, Eq)] 575 575 struct LocalPackages { 576 576 - packages: HashMap<String, Version>, 576 576 + #[serde(deserialize_with = "gleam_core::config::map_with_package_name_keys::deserialize")] 577 577 + packages: HashMap<EcoString, Version>, 577 578 } 578 579 579 580 impl LocalPackages { 580 580 - pub fn extra_local_packages(&self, manifest: &Manifest) -> Vec<(String, Version)> { 581 581 + pub fn extra_local_packages(&self, manifest: &Manifest) -> Vec<(EcoString, Version)> { 581 582 let manifest_packages: HashSet<_> = manifest 582 583 .packages 583 584 .iter() ··· 634 635 packages: manifest 635 636 .packages 636 637 .iter() 637 637 - .map(|p| (p.name.to_string(), p.version.clone())) 638 638 + .map(|p| (p.name.clone(), p.version.clone())) 638 639 .collect(), 639 640 } 640 641 } 642 642 + } 643 643 + 644 644 + #[test] 645 645 + fn local_packages_deserialise_ok() { 646 646 + let toml = r#" 647 647 + [packages] 648 648 + gleam_stdlib = "1.0.0" 649 649 + gleam_otp = "1.1.0" 650 650 + "#; 651 651 + let packages: LocalPackages = toml::from_str(toml).unwrap(); 652 652 + assert_eq!( 653 653 + packages, 654 654 + LocalPackages { 655 655 + packages: HashMap::from_iter([ 656 656 + ("gleam_stdlib".into(), Version::new(1, 0, 0)), 657 657 + ("gleam_otp".into(), Version::new(1, 1, 0)), 658 658 + ]) 659 659 + } 660 660 + ) 661 661 + } 662 662 + 663 663 + #[test] 664 664 + fn local_packages_deserialise_invalid_name() { 665 665 + let toml = r#" 666 666 + [packages] 667 667 + gleam_stdlib = "1.0.0" 668 668 + "../../stuff" = "1.1.0" 669 669 + "#; 670 670 + let error = toml::from_str::<LocalPackages>(toml) 671 671 + .expect_err("should fail to deserialise because of invalid name"); 672 672 + insta::assert_snapshot!(insta::internals::AutoName, error.to_string()); 641 673 } 642 674 643 675 fn is_same_requirements(

+9

compiler-cli/src/snapshots/gleam_cli__dependencies__local_packages_deserialise_invalid_name.snap

View file Reviewed

··· 1 1 + --- 2 2 + source: compiler-cli/src/dependencies.rs 3 3 + expression: error.to_string() 4 4 + --- 5 5 + TOML parse error at line 2, column 1 6 6 + | 7 7 + 2 | [packages] 8 8 + | ^^^^^^^^^^ 9 9 + invalid value: string "../../stuff", expected a package name containing only lowercase letter, numbers, and underscores

+7 -9

compiler-core/src/config.rs

View file Reviewed

··· 34 34 Runtime::NodeJs 35 35 } 36 36 37 37 - pub type Dependencies = HashMap<EcoString, Requirement>; 38 38 - 39 37 #[derive(Clone, Debug, PartialEq, Eq)] 40 38 pub struct SpdxLicense { 41 39 pub licence: String, ··· 166 164 #[serde( 167 165 default, 168 166 serialize_with = "ordered_map", 169 169 - deserialize_with = "dependencies_map::deserialize" 167 167 + deserialize_with = "map_with_package_name_keys ::deserialize" 170 168 )] 171 171 - pub dependencies: Dependencies, 169 169 + pub dependencies: HashMap<EcoString, Requirement>, 172 170 #[serde( 173 171 default, 174 172 alias = "dev-dependencies", 175 173 serialize_with = "ordered_map", 176 176 - deserialize_with = "dependencies_map::deserialize" 174 174 + deserialize_with = "map_with_package_name_keys ::deserialize" 177 175 )] 178 178 - pub dev_dependencies: Dependencies, 176 176 + pub dev_dependencies: HashMap<EcoString, Requirement>, 179 177 #[serde(default)] 180 178 pub repository: Option<Repository>, 181 179 #[serde(default)] ··· 217 215 } 218 216 219 217 impl PackageConfig { 220 220 - pub fn dependencies_for(&self, mode: Mode) -> Result<Dependencies> { 218 218 + pub fn dependencies_for(&self, mode: Mode) -> Result<HashMap<EcoString, Requirement>> { 221 219 match mode { 222 220 Mode::Dev | Mode::Lsp => self.all_direct_dependencies(), 223 221 Mode::Prod => Ok(self.dependencies.clone()), ··· 226 224 227 225 // Return all the dependencies listed in the configuration, that is, all the 228 226 // direct dependencies, both in the `dependencies` and `dev_dependencies`. 229 229 - pub fn all_direct_dependencies(&self) -> Result<Dependencies> { 227 227 + pub fn all_direct_dependencies(&self) -> Result<HashMap<EcoString, Requirement>> { 230 228 let mut deps = 231 229 HashMap::with_capacity(self.dependencies.len() + self.dev_dependencies.len()); 232 230 for (name, requirement) in self.dependencies.iter().chain(&self.dev_dependencies) { ··· 1207 1205 } 1208 1206 } 1209 1207 1210 1210 - pub(crate) mod dependencies_map { 1208 1208 + pub mod map_with_package_name_keys { 1211 1209 use ecow::EcoString; 1212 1210 use serde::{Deserialize, Deserializer, de}; 1213 1211 use std::collections::HashMap;

+1 -1

compiler-core/src/manifest.rs

View file Reviewed

··· 13 13 pub struct Manifest { 14 14 #[serde( 15 15 serialize_with = "ordered_map", 16 16 - deserialize_with = "super::config::dependencies_map::deserialize" 16 16 + deserialize_with = "super::config::map_with_package_name_keys ::deserialize" 17 17 )] 18 18 pub requirements: HashMap<EcoString, Requirement>, 19 19 #[serde(serialize_with = "sorted_vec")]