hecks 3.0.2 → 3.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 86690f16283c3330223e64f48f16b14746470206e24f173e7ba0202cd19509fb
-  data.tar.gz: 2be48976ef5008c1cfeeb141f6c1a452be65f547334dd84b5f5b4dfebd319ec0
+  metadata.gz: 46f6f36759cf946f2fd26b0b11b0ec64b02b7b84e1213fcf239a08aa314d0168
+  data.tar.gz: 295310e1f10f391cfdc53900f7eda2ee6b96db34ced1e93fbd73e50978b6fa07
 SHA512:
-  metadata.gz: be69a5d8669de20178d1d7c20f51b395105e94ba82c6b30dfbbce3c415299b413973fcfb79a6a52e3404d282d5873e6ea1b91aae96aae1e95b8b84646843ac7b
-  data.tar.gz: d3a40b9ef1b73168adcb2659eb423760ea1f835390101005ec5ab19503d47ac19257bfb69fd3f0d1e7b27e2f59317faecc7c32a406a1deedf07f795d88c95184
+  metadata.gz: 9d7a89486e004a7e786177ee9debfb4fcdc1e331611da9293a29cc2e16e0b4f2b388d718d3062e7b236e27b2655f16282e6e1b1065bb151fcdd8bb67c839a34f
+  data.tar.gz: 9713d8af8eb4eebdf7885e0ec9821e304f0d6be393e22968c32b971e83d920e6f4ecfa52ce3ee46a19336de8a4e50d5c70d20c443784042aeac5607046ceb9ce

data/lib/hecks/embryonaut_bluebook.rb

@@ -7,6 +7,10 @@ module Hecks
     autoload :Vendor, File.join(__dir__, "embryonaut_bluebook/vendor")
     autoload :VendorCli, File.join(__dir__, "embryonaut_bluebook/vendor_cli")
 
+    # The shape `hecks vendor` accepts for a package directory name. The name is joined into a
+    # path that `load!` evaluates as Ruby, so `../x` or an absolute path must never reach it.
+    PACKAGE_NAME = /\A[a-z][a-z0-9_]*\z/
+
     # Loads a vendored embryonaut bluebook package's `.bluebook` files, once
     # per registry.
     #
@@ -23,6 +27,12 @@ module Hecks
               "uses_embryonaut_bluebook(#{name.inspect}) needs a registry with a root to vendor from"
       end
 
+      unless name.to_s.match?(PACKAGE_NAME)
+        raise Runtime::WiringError,
+              "uses_embryonaut_bluebook(#{name.inspect}) is not a package name — it must match " \
+              "[a-z][a-z0-9_]* (the name `hecks vendor` accepts)"
+      end
+
       return if registry.bluebook(Naming.pascal(name.to_s))
 
       dir   = File.join(registry.root, "vendor", "embryonaut_bluebooks", name.to_s, "bluebook")

data/lib/hecks/grammar/evolve.rb

@@ -53,9 +53,30 @@ module Hecks
         raise
       end
 
+      # Where the language's own bluebooks live: this checkout's, unless a block is running under
+      # `with_language_dir`.
+      #
+      # @return [String] the directory holding the syntax tables
+      def language_dir = @language_dir || File.expand_path("../language", __dir__)
+
+      # Runs the block with every table read and edit aimed at `dir`, so a caller can try real
+      # edits on a copy. The language's own files are what other processes load, so an edit that
+      # lands on them, even one put back afterwards, can be loaded half-made.
+      #
+      # @param dir [String] a directory laid out like `lib/hecks/language`
+      # @yield the work to run against `dir`
+      # @return [Object] what the block returns
+      def with_language_dir(dir)
+        previous = @language_dir
+        @language_dir = dir
+        yield
+      ensure
+        @language_dir = previous
+      end
+
       # Every syntax-table file declaring a KeywordSeed or ArgumentSeed value object.
       def syntax_paths
-        Dir.glob(File.expand_path("../language/**/*.bluebook", __dir__)).select do |path|
+        Dir.glob(File.join(language_dir, "**/*.bluebook")).select do |path|
           source = read_source(path)
           source.include?('value_object "KeywordSeed"') || source.include?('value_object "ArgumentSeed"')
         end

data/lib/hecks/version.rb

@@ -1,5 +1,5 @@
 module Hecks
   # Read directly by the gemspec, so this file must never require the
   # rest of the gem (its dependencies aren't resolved yet at that point).
-  VERSION = "3.0.2".freeze
+  VERSION = "3.0.3".freeze
 end

data/rust/build/src/resolve.rs

@@ -94,7 +94,20 @@ fn resolve_json(parser_bin: &Path, chapter_name: &str, hecksagon_path: &Path, ke
     Ok(names.iter().filter_map(Json::as_str).map(str::to_string).collect())
 }
 
+/// `/\A[a-z][a-z0-9_]*\z/` — the shape `hecks vendor` accepts for a package directory name.
+/// The name is joined into a path and, through its chapter, into a directory the build deletes,
+/// so `../x` or an absolute path must never reach either.
+pub fn valid_package_name(name: &str) -> bool {
+    let mut chars = name.chars();
+    matches!(chars.next(), Some(c) if c.is_ascii_lowercase()) && chars.all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '_')
+}
+
 pub fn vendored_bluebook_files(domain: &Path, pkg_name: &str) -> Result<Vec<PathBuf>, String> {
+    if !valid_package_name(pkg_name) {
+        return Err(format!(
+            "uses_embryonaut_bluebook {pkg_name:?} is not a package name — it must match [a-z][a-z0-9_]* (the name `hecks vendor` accepts)"
+        ));
+    }
     let dir = domain.join("vendor").join("embryonaut_bluebooks").join(pkg_name).join("bluebook");
     if !dir.is_dir() {
         return Err(format!(
@@ -109,6 +122,18 @@ pub fn vendored_bluebook_files(domain: &Path, pkg_name: &str) -> Result<Vec<Path
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_package_name_that_is_a_path_is_refused_before_any_directory_is_touched() {
+        for name in ["../x", "a/b", "/etc", "", "X", "1st", "a-b", "a b", ".."] {
+            assert!(!valid_package_name(name), "{name:?}");
+            let refusal = vendored_bluebook_files(Path::new("/nonexistent"), name).unwrap_err();
+            assert!(refusal.contains("is not a package name"), "{refusal}");
+        }
+        for name in ["payments", "console_settings", "a1"] {
+            assert!(valid_package_name(name), "{name:?}");
+        }
+    }
+
     #[test]
     fn pascal_cases_snake_case_stems() {
         assert_eq!(pascal("governance"), "Governance");

data/rust/host/HECKS_RELEASE

@@ -1 +1 @@
-3.0.2
+3.0.3

data/rust/host/src/web.rs

@@ -373,10 +373,11 @@ async fn accounts_me_route(domain_ir: &Value, cookies: &HashMap<String, String>,
     }
 }
 
-// GET /members: admitted people as JSON, for a caller holding the
-// account cookie but not the Governance session /admin/members needs.
+// GET /members: admitted people as JSON, for an Admin or Owner holding the
+// account cookie but not the Governance session /admin/members needs. The list
+// is every person's name, email and role, so a plain member does not get it.
 async fn members_route(domain_ir: &Value, cookies: &HashMap<String, String>, secret: &str, client: &Mutex<Client>) -> Value {
-    if let Err(response) = active_session_email(domain_ir, cookies, secret, client).await {
+    if let Err(response) = newsletter_send::require_admin(domain_ir, cookies, secret, client).await {
         return response;
     }
     match auth::all_people(client, domain_ir).await {
@@ -2302,6 +2303,32 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn members_route_refuses_a_plain_member_with_a_403_and_no_people() {
+        let secret = "s3cret";
+        let (client, domain_ir) = scratch_members_db("hecks_host_web_test_members_route_403").await;
+        client
+            .lock()
+            .await
+            .execute(
+                "INSERT INTO acme_member_head_snapshot_1 (id, ordinal, state) VALUES ($1, 0, $2::jsonb)",
+                &[
+                    &"max@example.com",
+                    &json!({"name": {"value": "Max"}, "email": {"value": "max@example.com"},
+                            "role": {"value": "Member"}, "identity_id": {"value": "id-2"}}),
+                ],
+            )
+            .await
+            .unwrap();
+
+        let response = members_route(&domain_ir, &session_cookies(secret, "max@example.com"), secret, &client).await;
+        assert_eq!(response["statusCode"], 403, "{response:?}");
+        let body = response["body"].as_str().unwrap();
+        for leaked in ["zed@example.com", "amy@example.com", "Zed"] {
+            assert!(!body.contains(leaked), "{leaked:?} leaked to a plain member: {body}");
+        }
+    }
+
     fn session_cookies(secret: &str, email: &str) -> HashMap<String, String> {
         let mut cookies = HashMap::new();
         cookies.insert(auth::account_cookie_name(), auth::account_token(secret, email, 60));
@@ -2808,9 +2835,15 @@ mod tests {
             } else {
                 assert_eq!((add, registrations, disable, enable), (403, 403, 403, 403), "{caller} is refused everywhere");
             }
-            // Listing needs access, not admin: a Member may list, a stranger may not.
+            // Listing is an admin gate too: it carries every person's email and role, so an
+            // Admin or Owner lists, a Member is refused, and a stranger has no session at all.
             let listing = status_of(members_route(&domain_ir, &cookies, secret, &client).await).await;
-            assert_eq!(listing, if caller == "stranger@example.com" { 401 } else { 200 }, "{caller} listing");
+            let expected = match caller {
+                "stranger@example.com" => 401,
+                _ if admits => 200,
+                _ => 403,
+            };
+            assert_eq!(listing, expected, "{caller} listing");
         }
 
         // Anonymous: 401 on every route, before any role is looked at.

data/rust/project_rust_pipeline.rb

@@ -70,6 +70,10 @@ module RustProjectPipeline
     # vendor/embryonaut_bluebooks/<name>/bluebook/, sorted. A vendored
     # package has no .hecksagon of its own either, just its .bluebook(s).
     chapters += uses_embryonaut_bluebook_names.map do |pkg_name|
+      unless pkg_name.to_s.match?(Hecks::EmbryonautBluebook::PACKAGE_NAME)
+        abort "hecks project_rust (Rust path): uses_embryonaut_bluebook #{pkg_name.inspect} is not a package " \
+              "name — it must match [a-z][a-z0-9_]* (the name `hecks vendor` accepts)"
+      end
       pkg_dir = File.join(domain, "vendor", "embryonaut_bluebooks", pkg_name.to_s, "bluebook")
       pkg_files = Dir.glob(File.join(pkg_dir, "*.bluebook")).sort
       if pkg_files.empty?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hecks
 version: !ruby/object:Gem::Version
-  version: 3.0.2
+  version: 3.0.3
 platform: ruby
 authors:
 - Chris Young