Théophane Hufschmitt e5a211d77e Add an owner check when searching for the flake root ... When searching up the filesystem for the root of the flake (the directory that contains the `flake.nix`), don’t go anywhere up if we encounter a directory owned by a different user, as otherwise this other user could craft an arbitrary flake, potentially causing bad stuff to happen (shouldn’t in most cases since all it could do is run sanboxed builds, but there’s probably a lot of edge-cases that would make this very undesirable). This is to fix Nix’s equivalent of CVE-2022-24765 This check is intentionnally not applied to the exact directory specified since: 1. It’s up to the user to not point to an untrusted input 2. In multi-user Nix installations, that would prevent from using a flake in the Nix store (since it’s owned by root and not the current user) Fix #6408		2023-06-19 15:01:12 +02:00
..
internal-api	Generate API docs with Doxygen	2023-03-10 12:51:06 -05:00
manual	Add an owner check when searching for the flake root	2023-06-19 15:01:12 +02:00