webdesus / fs_extra

Expanding opportunities standard library std::fs and std::io
MIT License
297 stars 47 forks source link

UNC-stripping is risky #29

Open kornelski opened 4 years ago

kornelski commented 4 years ago
        let mut path = result_path.as_os_str().to_os_string().into_string()?;
        if path.find("\\\\?\\") == Some(0) {
            path = path[4..].to_string();
        }

First, this is relatively inefficient, as it creates a copy of the path and then searches entire path.

But most importantly, this isn't safe. UNC paths can change their meaning if they're reinterpreted as DOS paths.

Consider using https://lib.rs/crates/dunce which strips the prefix only when it is safe to do so.