search

rust-lang / crates.io

The Rust package registry
https://crates.io
Apache License 2.0
2.93k stars 597 forks source link

Crates with paths differing only by case are allowed #8410

Open kornelski opened 5 months ago

kornelski commented 5 months ago

Current Behavior

It's possible to have a tarball that contains multiple files with paths that are identical except case, e.g. readme.md and README.MD. On case-insensitive file systems on of these will overwrite the other. Tricks like these could confuse tools or even hide files from code reviews performed on macOS or Windows.

e.g. Cargo can pacakge duplicate cargo.lock file, and cargo.toml breaks docs.rs but not crates.io.

I haven't checked whether it's still allowed to have completely duplicate paths, but there are many old crates with duplicate files, e.g. two Cargo.toml.orig files: https://crates.io/crates/nucleo-f103rb/0.3.0

Expected Behavior

I think it'd be best if crates.io refused to accept any tarballs with potentially duplicate paths. It's not sufficient to rely on cargo publish to work correctly, because attackers could upload arbitrary tarballs. Even if crates.io could safely deal with weird tarballs, they can be causing trouble in 3rd party tools.

Steps To Reproduce

No response

Environment

No response

Anything else?

No response

Turbo87 commented 5 months ago

we currently only check this scenario for Cargo.toml files, but I tend to agree that we might want to restrict this to all files.

@rust-lang/crates-io any thoughts on this?

LawnGnome commented 5 months ago

@rust-lang/crates-io any thoughts on this?

I don't think there's a legitimate case where anyone would actually want this, so yes, I'd be supportive of checking this on publish.

LawnGnome commented 3 months ago

Reopening, since we ended up reverting #8788. (See that PR for details.)

Turbo87 commented 2 weeks ago

this issue is blocked on: