flowproof 0.23.28__tar.gz → 0.23.30__tar.gz

{flowproof-0.23.28 → flowproof-0.23.30}/Cargo.lock

@@ -141,15 +141,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
-dependencies = [
- "derive_arbitrary",
-]
-
 [[package]]
 name = "ascii"
 version = "1.1.0"
@@ -169,11 +160,12 @@ dependencies = [
 
 [[package]]
 name = "atoi_simd"
-version = "0.16.1"
+version = "0.18.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c2a49e05797ca52e312a0c658938b7d00693ef037799ef7187678f212d7684cf"
+checksum = "f3cdb3708a128e559a30fb830e8a77a5022ee6902806925c216658652b452a44"
 dependencies = [
  "debug_unsafe",
+ "rustversion",
 ]
 
 [[package]]
@@ -309,9 +301,9 @@ checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
 [[package]]
 name = "calamine"
-version = "0.28.0"
+version = "0.38.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "15e02a18e79de779a78b0a6ec84a3deed1ff0607dd970a11369f993263f99f1a"
+checksum = "f431b67cba6122a1f7d26b7adafc71bbdf07026095fe811f5efc025d8748e1d8"
 dependencies = [
  "atoi_simd",
  "byteorder",
@@ -628,9 +620,9 @@ dependencies = [
 
 [[package]]
 name = "ctutils"
-version = "0.4.2"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+checksum = "a2376ffd6f96d8a9db59875b4b6b0237d6900b5baf64279714e05493ce64828a"
 dependencies = [
  "cmov",
 ]
@@ -688,17 +680,6 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
-[[package]]
-name = "derive_arbitrary"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "derive_builder"
 version = "0.20.2"
@@ -930,7 +911,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-adapters"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "anyhow",
  "flowproof-driver",
@@ -949,7 +930,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-agent"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "base64",
  "chrono",
@@ -959,7 +940,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_norway",
  "thiserror 2.0.18",
  "tiny_http",
  "ureq",
@@ -968,7 +949,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-cli"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "ab_glyph",
  "chrono",
@@ -985,7 +966,7 @@ dependencies = [
  "rpassword",
  "serde",
  "serde_json",
- "serde_yaml",
+ "serde_norway",
  "sha2 0.10.9",
  "tiny_http",
  "ureq",
@@ -994,7 +975,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-driver"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "calamine",
  "flowproof-trace",
@@ -1010,7 +991,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-python"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "flowproof-agent",
  "flowproof-cli",
@@ -1022,7 +1003,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-replay"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "chrono",
  "flowproof-agent",
@@ -1036,7 +1017,7 @@ dependencies = [
 
 [[package]]
 name = "flowproof-trace"
-version = "0.23.28"
+version = "0.23.30"
 dependencies = [
  "jsonschema",
  "regex",
@@ -2169,9 +2150,9 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.37.5"
+version = "0.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
+checksum = "41b1177fdf999d2321d3fb46ff47159d9c1fb9ad66a4879f8c50a0b504615e9b"
 dependencies = [
  "encoding_rs",
  "memchr",
@@ -2571,9 +2552,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "log",
  "once_cell",
@@ -2634,9 +2615,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -2761,16 +2742,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "serde_yaml"
-version = "0.9.34+deprecated"
+name = "serde_norway"
+version = "0.9.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+checksum = "e408f29489b5fd500fab51ff1484fc859bb655f32c671f307dcd733b72e8168c"
 dependencies = [
  "indexmap",
  "itoa",
  "ryu",
  "serde",
- "unsafe-libyaml",
+ "unsafe-libyaml-norway",
 ]
 
 [[package]]
@@ -3142,6 +3123,12 @@ dependencies = [
  "pom",
 ]
 
+[[package]]
+name = "typed-path"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ce898823d8cd0f028662d2f349694b1af0a5cc9be83f1d213a00d3147445e1e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -3211,10 +3198,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
 
 [[package]]
-name = "unsafe-libyaml"
-version = "0.2.11"
+name = "unsafe-libyaml-norway"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+checksum = "b39abd59bf32521c7f2301b52d05a6a2c975b6003521cbd0c6dc1582f0a22104"
 
 [[package]]
 name = "untrusted"
@@ -3420,18 +3407,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "e49d0e65abc00c142e8f9428da991da9f1a250c39be97459901eb12b9b49f62a"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "f5f280bbb2b287bc8e7de7e3852945a0ff50d1bbcb5ed42b6c7a568c546df171"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -3890,15 +3877,18 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "4.6.1"
+version = "9.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
+checksum = "1156b39d142a34b999c2310a50455e0cb3760bf7efad0122f796d813bee26ccb"
 dependencies = [
- "arbitrary",
  "crc32fast",
  "flate2",
+ "getrandom 0.4.3",
  "indexmap",
  "memchr",
+ "nix",
+ "typed-path",
+ "windows-sys 0.61.2",
  "zopfli",
 ]
 

{flowproof-0.23.28 → flowproof-0.23.30}/Cargo.toml

@@ -22,7 +22,7 @@ members = ["crates/flowproof-driver", "crates/flowproof-trace", "crates/flowproo
 exclude = ["spike/windows-containment"]
 
 [workspace.package]
-version = "0.23.28"
+version = "0.23.30"
 edition = "2021"
 license = "Apache-2.0"
 repository = "https://github.com/automators-com/flowproof"
@@ -44,7 +44,13 @@ pdf-extract = "0.12"
 serde = { version = "1", features = ["derive"] }
 regex = "1"
 serde_json = "1"
-serde_yaml = "0.9"
+# serde_yaml (dtolnay) is archived/unmaintained and pulls the unmaintained
+# unsafe-libyaml (RUSTSEC-2024-0449). serde_norway is the RustSec-recommended
+# maintained 0.9-compatible fork; it rides on the maintained
+# unsafe-libyaml-norway. Aliased back to `serde_yaml` so the ~124 existing
+# `serde_yaml::` call sites stay unchanged — the name is cosmetic, the crate
+# is serde_norway. (A6)
+serde_yaml = { package = "serde_norway", version = "0.9" }
 thiserror = "2"
 uuid = { version = "1", features = ["v4"] }
 

{flowproof-0.23.28 → flowproof-0.23.30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: flowproof
-Version: 0.23.28
+Version: 0.23.30
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python :: 3

{flowproof-0.23.28 → flowproof-0.23.30}/crates/flowproof-adapters/src/lib.rs

@@ -112,6 +112,12 @@ pub use web::shutdown_shared_browser;
 #[cfg(feature = "web")]
 pub use web::SharedBrowserGuard;
 
+/// The words a missing-browser failure starts with. By the time it reaches a
+/// caller it is only a message (the driver, the CLI and the desktop app all
+/// carry it as a string), so these words are what tells it apart from any
+/// other launch failure. Changing them breaks those callers.
+pub const NO_BROWSER: &str = "no browser found";
+
 #[derive(Debug, thiserror::Error)]
 pub enum AdapterError {
     #[error("adapter '{0}' is not implemented yet")]
@@ -120,6 +126,11 @@ pub enum AdapterError {
     UnsupportedPlatform(&'static str),
     #[error("web adapter: {0}")]
     Web(String),
+    /// No Chromium browser to drive: not a launch that went wrong but one
+    /// that could not start, and installing a browser fixes it. Starts with
+    /// [`NO_BROWSER`]; the web adapter's tests hold the two together.
+    #[error("no browser found: {0}")]
+    NoBrowser(String),
 }
 
 /// Names of the adapters compiled into this build.

{flowproof-0.23.28 → flowproof-0.23.30}/crates/flowproof-adapters/src/web.rs

@@ -4,7 +4,7 @@
 //!
 //! Selector mapping: `css` payload key, else `#<automation_id>`. `launch`
 //! interprets `command` as the URL to open. The Chromium binary is found via
-//! the `CHROME` env var or platform auto-detection.
+//! the `CHROME` env var or platform auto-detection ([`find_browser`]).
 
 use std::sync::{Arc, Mutex, OnceLock};
 use std::time::{Duration, Instant};
@@ -897,19 +897,132 @@ fn present_headed_window(window: &impl HeadedTabWindow, headed: bool) -> Result<
     Ok(())
 }
 
+/// What a person reads when no browser is found: which browsers work, and the
+/// two ways to give flowproof one.
+const NO_BROWSER_HELP: &str = "web flows run in Google Chrome, Microsoft Edge, Chromium or \
+     Brave, and none is installed where flowproof looks. Install one, or set CHROME to the \
+     path of one.";
+
+/// The browser to launch. `CHROME` wins when set, and a `CHROME` naming a file
+/// that is not there is an error rather than a quiet fall-back to whatever
+/// else is installed: the person asked for that browser. Otherwise the places
+/// headless_chrome looks, first and unchanged, so nobody's browser changes
+/// under them; then the Chromium browsers it misses.
+fn find_browser() -> Result<std::path::PathBuf, AdapterError> {
+    pick_browser(
+        std::env::var_os("CHROME"),
+        headless_chrome::browser::default_executable,
+        &extra_browser_candidates(std::env::consts::OS, std::env::var_os),
+        |path| path.is_file(),
+    )
+}
+
+/// [`find_browser`] with the environment, the default lookup and the
+/// filesystem passed in, so every branch is testable on any host.
+fn pick_browser(
+    chrome: Option<std::ffi::OsString>,
+    default: impl FnOnce() -> Result<std::path::PathBuf, String>,
+    extra: &[std::path::PathBuf],
+    exists: impl Fn(&std::path::Path) -> bool,
+) -> Result<std::path::PathBuf, AdapterError> {
+    if let Some(chrome) = chrome.filter(|c| !c.is_empty()) {
+        let path = std::path::PathBuf::from(chrome);
+        if exists(&path) {
+            return Ok(path);
+        }
+        return Err(AdapterError::NoBrowser(format!(
+            "CHROME is set to {}, and there is no browser there. Point it at a Chrome, \
+             Edge, Chromium or Brave executable, or unset it to let flowproof look.",
+            path.display()
+        )));
+    }
+    if let Ok(path) = default() {
+        return Ok(path);
+    }
+    extra
+        .iter()
+        .find(|path| exists(path))
+        .cloned()
+        .ok_or_else(|| AdapterError::NoBrowser(NO_BROWSER_HELP.into()))
+}
+
+/// Chromium browsers headless_chrome does not look for: per-user installs of
+/// Chrome, Edge and Chromium (where they land without admin rights) and Brave.
+/// Other Chromium browsers stay out until one is seen driving a flow.
+fn extra_browser_candidates(
+    os: &str,
+    env: impl Fn(&'static str) -> Option<std::ffi::OsString>,
+) -> Vec<std::path::PathBuf> {
+    let dir = |key: &'static str| {
+        env(key)
+            .filter(|v| !v.is_empty())
+            .map(std::path::PathBuf::from)
+    };
+    let mut candidates = Vec::new();
+    match os {
+        "macos" => {
+            // The app bundle and its executable share a name for all four.
+            let apps = [
+                "Google Chrome",
+                "Microsoft Edge",
+                "Chromium",
+                "Brave Browser",
+            ];
+            let user_apps = dir("HOME").map(|home| home.join("Applications"));
+            for root in user_apps
+                .into_iter()
+                .chain([std::path::PathBuf::from("/Applications")])
+            {
+                for app in apps {
+                    candidates.push(root.join(format!("{app}.app/Contents/MacOS/{app}")));
+                }
+            }
+        }
+        "windows" => {
+            let chrome = ["Google", "Chrome", "Application", "chrome.exe"];
+            let edge = ["Microsoft", "Edge", "Application", "msedge.exe"];
+            let brave = ["BraveSoftware", "Brave-Browser", "Application", "brave.exe"];
+            let installs: [(&str, &[[&str; 4]]); 3] = [
+                ("LOCALAPPDATA", &[chrome, edge, brave]),
+                ("ProgramFiles", &[chrome, edge, brave]),
+                ("ProgramFiles(x86)", &[chrome, brave]),
+            ];
+            for (key, browsers) in installs {
+                let Some(root) = dir(key) else { continue };
+                for parts in browsers {
+                    candidates.push(
+                        parts
+                            .iter()
+                            .fold(root.clone(), |path, part| path.join(part)),
+                    );
+                }
+            }
+        }
+        _ => {
+            if let Some(path) = env("PATH") {
+                for bin in std::env::split_paths(&path) {
+                    for name in ["brave-browser", "brave"] {
+                        candidates.push(bin.join(name));
+                    }
+                }
+            }
+        }
+    }
+    candidates
+}
+
 /// Build the launch options, split out from [`launch_browser`] so the headless
 /// decision is testable without starting a browser.
 fn launch_options_for(
     os_args: &[std::ffi::OsString],
     headed: bool,
+    path: std::path::PathBuf,
 ) -> Result<LaunchOptions<'_>, AdapterError> {
     let mut options = LaunchOptions::default_builder();
     options.headless(!headed).sandbox(false);
     options.idle_browser_timeout(BROWSER_IDLE_TIMEOUT);
     options.args(os_args.iter().map(AsRef::as_ref).collect());
-    if let Ok(path) = std::env::var("CHROME") {
-        options.path(Some(path.into()));
-    }
+    options.path(Some(path));
     options
         .build()
         .map_err(|e| AdapterError::Web(format!("building launch options: {e}")))
@@ -1052,7 +1165,7 @@ fn settled_scene(
 fn launch_browser(extra_args: &[String]) -> Result<Browser, AdapterError> {
     let headed = headed_requested();
     let os_args: Vec<std::ffi::OsString> = extra_args.iter().map(Into::into).collect();
-    let options = launch_options_for(&os_args, headed)?;
+    let options = launch_options_for(&os_args, headed, find_browser()?)?;
     Browser::new(options)
         .map_err(|e| AdapterError::Web(launch_failure_message(&e.to_string(), headed)))
 }
@@ -5978,14 +6091,108 @@ mod tests {
     #[test]
     fn headed_flips_the_headless_launch_option() {
         let no_args: Vec<std::ffi::OsString> = Vec::new();
+        let chrome = || std::path::PathBuf::from("/opt/chrome");
 
-        let headless = super::launch_options_for(&no_args, false).expect("options build");
+        let headless = super::launch_options_for(&no_args, false, chrome()).expect("options build");
         assert!(headless.headless, "default must stay headless");
+        assert_eq!(
+            headless.path,
+            Some(chrome()),
+            "the found browser is the one launched"
+        );
 
-        let headed = super::launch_options_for(&no_args, true).expect("options build");
+        let headed = super::launch_options_for(&no_args, true, chrome()).expect("options build");
         assert!(!headed.headless, "FLOWPROOF_HEADED must show the window");
     }
 
+    /// The order the browser is chosen in, and what a person reads when there
+    /// is none. The message must start with `NO_BROWSER`: the CLI and the
+    /// desktop app recognise the failure by those words alone.
+    #[test]
+    fn a_browser_is_chosen_from_chrome_then_the_defaults_then_the_extras() {
+        use std::path::{Path, PathBuf};
+        let found = |p: &Path| p == Path::new("/set/chrome") || p == Path::new("/extra/brave");
+        let default_finds = || -> Result<PathBuf, String> { Ok(PathBuf::from("/default/chrome")) };
+        let default_misses = || -> Result<PathBuf, String> {
+            Err("Could not auto detect a chrome executable".into())
+        };
+        let extras = [
+            PathBuf::from("/extra/missing"),
+            PathBuf::from("/extra/brave"),
+        ];
+
+        let chosen = super::pick_browser(Some("/set/chrome".into()), default_finds, &extras, found);
+        assert_eq!(chosen.expect("CHROME"), PathBuf::from("/set/chrome"));
+
+        // An empty CHROME is unset, not a path.
+        let chosen = super::pick_browser(Some("".into()), default_finds, &extras, found);
+        assert_eq!(chosen.expect("default"), PathBuf::from("/default/chrome"));
+
+        // headless_chrome's own lookup still comes first, so nobody's browser
+        // changes when a second one is installed.
+        let chosen = super::pick_browser(None, default_finds, &extras, found);
+        assert_eq!(chosen.expect("default"), PathBuf::from("/default/chrome"));
+
+        let chosen = super::pick_browser(None, default_misses, &extras, found);
+        assert_eq!(chosen.expect("extra"), PathBuf::from("/extra/brave"));
+
+        let none = super::pick_browser(None, default_misses, &extras[..1], found)
+            .expect_err("nothing installed")
+            .to_string();
+        assert!(none.starts_with(crate::NO_BROWSER), "{none}");
+        assert!(none.contains("set CHROME"), "names the way out: {none}");
+
+        // A CHROME pointing nowhere is the person's choice gone wrong: say so
+        // rather than quietly launching some other browser.
+        let wrong = super::pick_browser(Some("/gone/chrome".into()), default_finds, &extras, found)
+            .expect_err("CHROME names nothing")
+            .to_string();
+        assert!(wrong.starts_with(crate::NO_BROWSER), "{wrong}");
+        assert!(
+            wrong.contains("/gone/chrome"),
+            "names the path it tried: {wrong}"
+        );
+    }
+
+    /// The per-user installs are the point: Chrome and Edge installed without
+    /// admin rights land there, and headless_chrome does not look.
+    #[test]
+    fn extra_candidates_cover_per_user_installs_and_brave() {
+        use std::ffi::OsString;
+        let env = |key: &str| -> Option<OsString> {
+            match key {
+                "HOME" => Some("/Users/ana".into()),
+                "LOCALAPPDATA" => Some("C:\\Users\\ana\\AppData\\Local".into()),
+                "PATH" => Some("/usr/bin".into()),
+                _ => None,
+            }
+        };
+        let shown = |os: &str| -> Vec<String> {
+            super::extra_browser_candidates(os, env)
+                .iter()
+                .map(|p| p.to_string_lossy().replace('\\', "/"))
+                .collect()
+        };
+
+        let mac = shown("macos");
+        assert!(mac.contains(
+            &"/Users/ana/Applications/Google Chrome.app/Contents/MacOS/Google Chrome".to_string()
+        ));
+        assert!(mac
+            .contains(&"/Applications/Brave Browser.app/Contents/MacOS/Brave Browser".to_string()));
+
+        let windows = shown("windows");
+        assert!(windows.contains(
+            &"C:/Users/ana/AppData/Local/Google/Chrome/Application/chrome.exe".to_string()
+        ));
+        assert!(
+            windows.iter().all(|p| p.starts_with("C:/Users/ana")),
+            "an unset ProgramFiles adds nothing: {windows:?}"
+        );
+
+        assert_eq!(shown("linux"), ["/usr/bin/brave-browser", "/usr/bin/brave"]);
+    }
+
     /// A visible shared browser leaks its keep-alive window into the user's
     /// desktop after the flow tab closes. Headless suites retain reuse; either
     /// explicit opt-out or headed mode must select one privately-owned process.
@@ -6259,7 +6466,8 @@ mod startup_tab_tests {
             return;
         }
         let browser = super::Browser::new(
-            super::launch_options_for(&[], true).expect("valid launch options"),
+            super::launch_options_for(&[], true, super::find_browser().expect("a browser"))
+                .expect("valid launch options"),
         )
         .expect("browser starts");
         let first = super::private_flow_tab(&browser).expect("flow tab opens");

{flowproof-0.23.28 → flowproof-0.23.30}/crates/flowproof-agent/src/heal.rs

@@ -6,7 +6,7 @@
 //! original as `<name>.proposed.jsonl` and is only applied on explicit
 //! request.
 
-use std::path::{Path, PathBuf};
+use std::path::{Component, Path, PathBuf};
 
 use flowproof_driver::AppDriver;
 use flowproof_trace::format::{Header, Step};
@@ -308,6 +308,19 @@ fn remap_selector_refs(value: &mut serde_json::Value, moved: &dyn Fn(usize) -> u
     }
 }
 
+/// A recording-bundle path from a trace header is trusted only when it stays a
+/// relative path inside the trace directory: every component must be `Normal`
+/// (which rejects an absolute root, `.`, and `..`) and it must contain no `\`,
+/// a path separator on Windows that would otherwise traverse there. Mirrors the
+/// CLI's suite-selection guard (`relative_path`).
+fn is_confined_rel(dir: &str) -> bool {
+    !dir.is_empty()
+        && !dir.contains('\\')
+        && Path::new(dir)
+            .components()
+            .all(|c| matches!(c, Component::Normal(_)))
+}
+
 /// The step time-range → frame files of one execution's recording bundle.
 /// Derivable purely from the structured data plus the content-named files.
 fn frames_for_range(
@@ -321,6 +334,15 @@ fn frames_for_range(
     let Some(recording) = &header.recording else {
         return Vec::new();
     };
+    // `recording.dir` comes from the trace header, which may be attacker-
+    // authored (an imported trace). Confine it to a child of `trace_dir` before
+    // reading the bundle or embedding its files into the diff HTML: an absolute
+    // path, a `..`, or a `\` (a separator on Windows) would otherwise point the
+    // page at files outside the recording. A bad value yields no frames rather
+    // than reaching out of the tree.
+    if !is_confined_rel(&recording.dir) {
+        return Vec::new();
+    }
     let dir = trace_dir.join(&recording.dir);
     let Ok(entries) = std::fs::read_dir(&dir) else {
         return Vec::new();
@@ -485,6 +507,24 @@ steps:
         MockAppDriver::new(&CALC_ELEMENTS).with_text("CalculatorResults", "Display is 8")
     }
 
+    #[test]
+    fn recording_dir_is_confined_to_the_trace_tree() {
+        // Legitimate bundle paths: relative, forward-slashed, no traversal.
+        assert!(is_confined_rel("recording"));
+        assert!(is_confined_rel("exec-0/recording"));
+
+        // A header must not point the diff page outside the trace directory.
+        assert!(!is_confined_rel(""), "empty");
+        assert!(!is_confined_rel("../recording"), "parent traversal");
+        assert!(!is_confined_rel("a/../../etc"), "nested traversal");
+        assert!(!is_confined_rel("/etc/ssh"), "absolute (unix)");
+        assert!(!is_confined_rel("..\\recording"), "backslash traversal");
+        assert!(
+            !is_confined_rel("C:\\Windows"),
+            "backslash catches a Windows absolute path on any host"
+        );
+    }
+
     #[test]
     fn healthy_trace_needs_no_healing() {
         let dir = std::env::temp_dir().join("flowproof-heal-healthy");