Skip to content

fix(path): enforce filepath.Clean sanitization on cache paths and invocation directories#555

Open
HarshalPatel1972 wants to merge 1 commit into
magefile:masterfrom
HarshalPatel1972:fix/path-sanitization
Open

fix(path): enforce filepath.Clean sanitization on cache paths and invocation directories#555
HarshalPatel1972 wants to merge 1 commit into
magefile:masterfrom
HarshalPatel1972:fix/path-sanitization

Conversation

@HarshalPatel1972

Copy link
Copy Markdown

Description

This PR introduces explicit filepath.Clean() sanitization fences around user-supplied execution directory flags and runtime environment cache parameters. This prevents trailing slashes or redundant separators from propagating anomalies downstream into file operations.

Technical Context

When an execution invocation sets a working directory or reads the MAGEFILE_CACHE environment variables, the raw strings can infiltrate the pipeline with malformed layouts (e.g., /tmp/mage//bin or trailing delimiters).

While filepath.Join handles cleaning internally under specific criteria, direct usage of raw path references during isolated file lookups or short-circuit evaluations bypasses this safety net, causing native file system operations to error out with cryptic no such file or directory diagnostics.

Resolution Strategy

  • Cache Directory Normalization: Intercepted the boundary return in mg/runtime.go:CacheDir() to guarantee a sanitized, consistent path configuration across all cache lookups.
  • Invocation Sanitization: Enforced an early filepath.Clean() wrapper on the incoming inv.Dir state during early-stage flag processing in mage/main.go, cleaning up execution directory formats before child modules evaluate targets.

Copilot AI review requested due to automatic review settings June 25, 2026 11:42

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants