Merge #1190: Refuse non-local library paths in the library Cache (@Silvertree2010)

crates/engine/src/library.rs

@@ -491,6 +491,11 @@ impl Cache {
                 None => Err(EngineError::Other(crate::library_server::NOT_FETCHED.into())),
             };
         }
+        // The path comes from a document: a network share would be contacted (and on Windows get
+        // the opener's credentials) by the stat below.
+        if !craft_docpath::is_local(path) {
+            return Err(EngineError::Other(format!("{path}: a library is opened only from this computer")));
+        }
         let stamp = stat(path);
         // Checked before the cache: the limit is the caller's.
         if let Ok(st) = &stamp

crates/engine/src/library_path_tests.rs

@@ -28,3 +28,12 @@ fn a_local_library_path_is_still_followed() {
     let e = s.fetch_library(&missing.to_string_lossy(), false).expect_err("the file does not exist");
     assert!(!e.to_string().contains("only from this computer"), "a local path must not be refused as remote: {e}");
 }
+
+#[test]
+fn the_library_cache_refuses_a_path_off_this_computer() {
+    let mut cache = crate::library::Cache::default();
+    for path in [r"\\attacker.example\share\lib.figcraft", "//attacker.example/share/lib.figcraft"] {
+        let e = cache.load(path).expect_err(&format!("{path} must be refused"));
+        assert!(e.to_string().contains("only from this computer"), "{path}: {e}");
+    }
+}