Dylan M. Taylorandskylartaylor 683eb5e6e7 security: do not follow directory symlinks in cargo xtask stats (CWE-400) (#1845) ...

* security: do not follow directory symlinks in `cargo xtask stats` (CWE-400)

The stats walker descended with `Path::is_dir()`, which follows symlinks, and
kept no record of visited directories. A small acyclic graph of directory
aliases planted in a workspace package (for example through a contribution a
developer inspects) therefore caused exponentially repeated enumeration and file
reads, consuming CPU and I/O far beyond the repository's real size.

`walk` now inspects each entry's own `file_type()` and skips symlinks before
descending or reading, so directory aliases are never re-scanned. A traversal
budget (`MAX_ENTRIES`) bounds total work as defense in depth.

Addresses finding row 4.

* fix: report statistics traversal exhaustion

---------

Co-authored-by: skylartaylor <26588250+skylartaylor@users.noreply.github.com>

2026-10-22 17:04:35 -04:00

..

data

M0: CADCraft skeleton and vertical slice

2026-10-05 23:22:25 -04:00

src

security: do not follow directory symlinks in cargo xtask stats (CWE-400) (#1845)

2026-10-22 17:04:35 -04:00

Cargo.toml

Use chrono instead of hand-rolled UTC conversion (#1789)

2026-10-22 14:09:16 -04:00