erlef / rebar3_hex

Rebar3 Hex library
Apache License 2.0
101 stars 49 forks source link

Infinite recursion bug in rebar3_hex_file:expand_paths/2 #246

Closed starbelly closed 2 years ago

starbelly commented 3 years ago

A bug was raised on erlanger slack by @eproxus. It's possible with the perfect storm of symlinks to end up an infinite loop. This happens at https://github.com/erlef/rebar3_hex/blob/master/src/rebar3_hex_file.erl#L21 . Technically you could say there's a bug in OTP, but that's another story. Instead we need to change the way we discover files. I think we should probably do something similar to what mix hex is doing here https://github.com/hexpm/hex/blob/cf0b48d09b31312c574ec3ad57ef69278e66ff46/lib/mix/tasks/hex.build.ex#L359

The change should include tests to ensure we only expand paths that are given to expand_paths/2. Currently per the double star wildcard call, we end up expanding outside of those paths.

Diagnostics should be added as well such that if the new way of expanding paths and finding files the operator would get some indication that this is happening and where.