Don't allow custom build script path to escape package root

[yerke]

What does this PR try to resolve?

Don't allow custom build script path to escape package root.
Specifically the PR:

• shows an error for absolute paths in build field of Cargo.toml, since it will affect reproducibility.
• checks if the relative path in build field of Cargo.toml escapes the package root and if so, shows an error.

Fixes 11383

How should we test and review this PR?

This PR is still in the exploration stage and I will add tests after we settle on the general approach.

Additional information

This PR is still in the exploration stage and I want to get feedback from the team on the general approach.

[rustbot]

r? @epage

(rustbot has picked a reviewer for you, use r? to override)

[yerke]

@weihanglo I tried to follow your suggestions, but it didn't work. Specifically if the build script is outside of package directory, then build_ar_list doesn't even know about it. So I couldn't add the check there.

Eventually I found where build field parsing happens, and decided to add the check there.

Please let me know if this is an acceptable approach or not. I realize that there could be breakages for existing users who use build = "../path_to_build_script/build.rs" pattern and don't do cargo package or cargo publish. I am not sure how prevalent that pattern is.

EDIT: Failure of jobserver::makes_jobserver_used test is expected, since it uses build = "../dbuild.rs" pattern.

[weihanglo]

Thanks for the contribution!

Yup your concern is totally valid. It seems to prevent from having any build script outside the package root even for a local build. From my understanding we want the check only when packaging .crate file.

Specifically if the build script is outside of package directory, then build_ar_list doesn't even know about it. So I couldn't add the check there.

Have you tried this? You should be able to access build scripts and other targets from Target::src_path().

pkg.manifest().targets().filter(|t| t.src_path() /* and some logic to check */)

[weihanglo]

Ping @yerke. Just checking in to see if you are still interested in working on this, or if you had any questions.

r? @weihanglo
@rustbot author

[bors]

☔ The latest upstream changes (presumably #12768) made this pull request unmergeable. Please resolve the merge conflicts.

[weihanglo]

Close this in favor of another new active PR #12995

As always, thanks for the contribution, and looking forward to you coming back :)