mirror of
https://github.com/storytold/cadcraft.git
synced 2026-10-24 10:56:51 -06:00
Dylan M. Taylor
01bbdb24bc
The optional `CRAFT_FONTS_DIR` build input lets a font manifest select the file each face is embedded from. `build.rs` canonicalised that file with no containment check, so an absolute path, a `..` traversal, or a symlink inside the checkout could make the generated `include_bytes!` read an arbitrary file on the build host and expose its bytes through `CRAFT_FONTS` (CWE-22). It also printed the resolved path straight into Cargo's newline-delimited build-script protocol (`cargo::rerun-if-changed=…`). A path containing an embedded newline — reachable through a crafted symlink target — could inject a second directive such as `cargo::rustc-env=OUT_DIR=…`, redirecting the generated-source include to attacker-supplied Rust (CWE-74). - `resolve_font` rejects absolute and `..` manifest paths and requires the canonicalised result to stay inside the canonicalised checkout root. - `rerun_if_changed` refuses any path containing CR/LF before emitting the directive; `one_line` collapses CR/LF in checkout-derived diagnostics. Addresses findings rows 5 (CWE-22) and 14 (CWE-74).