Repository navigation
Reject relative tap names and keg aliases - #24411
Conversation
- `Tap.fetch` accepted empty, `.` and `..` name parts and `Keg#aliases` returned an install receipt's `aliases` unchecked. Linking and unlinking join both to `opt`, so a receipt naming the tap `../x` made `Keg#remove_old_aliases` remove the whole prefix and an alias such as `../../file` replaced a file outside it with a symlink to the keg. - Raise `Tap::InvalidNameError` for those tap name parts, which `Tap.with_formula_name` already treats as not taps, and ignore receipt aliases containing `/` or that are empty, `.` or `..`. ANT-2026-C2LX9SPL Signed-off-by: Patrick Linnane <patrick@linnane.io>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Filter keg aliases Library/Homebrew/keg.rb, Library/Homebrew/test/keg_spec.rb |
Keg#aliases excludes aliases containing / or equal to "", ".", or "..". Tests check that these values are excluded and that foo@1.0 is retained. |
Validate tap names Library/Homebrew/tap.rb, Library/Homebrew/test/tap_spec.rb |
Tap.fetch rejects empty and dot-path components. Tests check that ../foo, ./foo, and /foo raise Tap::InvalidNameError with an Invalid tap name message. |
Merge Risk: 
6f6cc
-
The change adds the stated name and alias validation with corresponding tests and is mergeable.
Pre-merge checks: 
-
Check name Status Explanation Title check The title "Reject relative tap names and keg aliases" matches the main change. Tap.fetch now raises Tap::InvalidNameError for empty, '.' and '..' name parts, and Keg#aliases drops receipt aliases cont… Description check The description explains the problem and the fix. It states that Tap.fetch accepted empty, '.' and '..' name parts and that Keg#aliases returned unchecked receipt aliases, which could remove a prefix … Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Title check
-
Explanation
The title "Reject relative tap names and keg aliases" matches the main change. Tap.fetch now raises Tap::InvalidNameError for empty, '.' and '..' name parts, and Keg#aliases drops receipt aliases containing '/' or equal to empty, '.' or '..'. The title is short, specific and free of noise.
Full details: Description check
-
Explanation
The description explains the problem and the fix. It states that Tap.fetch accepted empty, '.' and '..' name parts and that Keg#aliases returned unchecked receipt aliases, which could remove a prefix or replace an outside file. It also describes the new InvalidNameError behaviour and the alias filtering, and it lists the testing performed. It relates directly to the changeset.
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Tap.fetchaccepted empty,.and..name parts andKeg#aliasesreturned an install receipt'saliasesunchecked, so a receipt naming the tap../xmade linking, unlinking or uninstalling the keg remove the whole prefix and an alias such as../../filereplaced a file outside it with a symlink to the keg.Tap.fetchnow raisesTap::InvalidNameErrorfor those name parts, whichTap.with_formula_namealready treats as not taps, andKeg#aliasesignores entries containing/or that are empty,.or...brew benchmarkresults.brewcommands to reproduce the bug?brew lgtm(style, typechecking and tests) locally?Claude Code (Opus 5.5) wrote the change and tests, reproduced the prefix removal and the outside file replacement before the change and checked both fail with it (a sandboxed source build rewriting its receipt during
brew install, andbrew linkon hand-written receipts), checked that the new examples fail without the change and when any of the checks is removed and ranbrew lgtm --online.