Test Case: rust-instruct-1266

  1import os  2import sys  3import shutil  4import stat  5​  6def copy_with_library_override(src_dir, dst_dir, lib_path, compiler_path):  7    lib_files = {}  8    for root, _, files in os.walk(lib_path):  9        for f in files: 10            rel_path = os.path.relpath(os.path.join(root, f), lib_path) 11            lib_files[rel_path] = os.path.join(root, f) 12​ 13    for root, dirs, files in os.walk(src_dir): 14        rel_root = os.path.relpath(root, src_dir) 15        dst_root = os.path.join(dst_dir, rel_root) if rel_root != '.' else dst_dir 16        os.makedirs(dst_root, exist_ok=True) 17​ 18        for d in dirs: 19            os.makedirs(os.path.join(dst_root, d), exist_ok=True) 20​ 21        for f in files: 22            rel_file = os.path.normpath(os.path.join(rel_root, f)) if rel_root != '.' else f 23            if rel_file in lib_files: 24                src_file = lib_files[rel_file] 25            else: 26                src_file = os.path.join(root, f) 27            dst_file = os.path.join(dst_root, f) 28            shutil.copy2(src_file, dst_file) 29​ 30    for rel_file in lib_files: 31        dst_file = os.path.join(dst_dir, rel_file) 32        if os.path.isfile(dst_file): 33            st = os.stat(dst_file) 34            os.chmod(dst_file, st.st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) 35​ 36if __name__ == "__main__": 37    if len(sys.argv) != 5: 38        print("Usage: script.py <src_dir> <dst_dir> <lib_path> <compiler_path>") 39        sys.exit(1) 40    copy_with_library_override(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])

None

  1use std::{  2    env,  3    ffi::OsStr,  4    fs,  5    io,  6    os::unix::fs::PermissionsExt,  7    path::{Path, PathBuf},  8    process,  9}; 10​ 11fn main() -> io::Result<()> { 12    let mut args = env::args_os().skip(1); 13    let src_dir = args.next().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "missing source directory"))?; 14    let dst_dir = args.next().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "missing destination directory"))?; 15    let lib_path = args.next().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "missing library path"))?; 16    let _compiler_path = args.next().ok_or_else(|| io::Error::new(io::ErrorKind::InvalidInput, "missing compiler path"))?; 17​ 18    let src_dir = PathBuf::from(src_dir); 19    let dst_dir = PathBuf::from(dst_dir); 20    let lib_path = PathBuf::from(lib_path); 21​ 22    // Collect library files by relative path from lib_path root 23    let lib_files = collect_files(&lib_path)?; 24​ 25    copy_recursive(&src_dir, &dst_dir, &src_dir, &lib_path, &lib_files)?; 26​ 27    Ok(()) 28} 29​ 30fn collect_files(lib_root: &Path) -> io::Result<std::collections::HashMap<PathBuf, PathBuf>> { 31    let mut map = std::collections::HashMap::new(); 32    for entry in walkdir::WalkDir::new(lib_root).follow_links(false) { 33        let entry = entry?; 34        if entry.file_type().is_file() { 35            let rel_path = entry.path().strip_prefix(lib_root).unwrap().to_path_buf(); 36            map.insert(rel_path, entry.path().to_path_buf()); 37        } 38    } 39    Ok(map) 40} 41​ 42fn copy_recursive( 43    current_src: &Path, 44    current_dst: &Path, 45    src_root: &Path, 46    lib_root: &Path, 47    lib_files: &std::collections::HashMap<PathBuf, PathBuf>, 48) -> io::Result<()> { 49    for entry in fs::read_dir(current_src)? { 50        let entry = entry?; 51        let path = entry.path(); 52        let rel_path = path.strip_prefix(src_root).unwrap(); 53​ 54        if path.is_dir() { 55            let dst_subdir = current_dst.join(rel_path); 56            fs::create_dir_all(&dst_subdir)?; 57            copy_recursive(&path, current_dst, src_root, lib_root, lib_files)?; 58        } else if path.is_file() { 59            if lib_files.contains_key(rel_path) { 60                // Copy from library path instead of source 61                let lib_file = &lib_files[rel_path]; 62                let dst_file = current_dst.join(rel_path); 63                if let Some(parent) = dst_file.parent() { 64                    fs::create_dir_all(parent)?; 65                } 66                fs::copy(lib_file, &dst_file)?; 67                set_executable_bit(&dst_file)?; 68            } else { 69                // Copy from source unless inside library path 70                if !path.starts_with(lib_root) { 71                    let dst_file = current_dst.join(rel_path); 72                    if let Some(parent) = dst_file.parent() { 73                        fs::create_dir_all(parent)?; 74                    } 75                    fs::copy(&path, &dst_file)?; 76                } 77            } 78        } 79    } 80    Ok(()) 81} 82​ 83fn set_executable_bit(path: &Path) -> io::Result<()> { 84    let mut perms = fs::metadata(path)?.permissions(); 85    let mode = perms.mode(); 86    // Set owner, group, others execute bits 87    perms.set_mode(mode | 0o111); 88    fs::set_permissions(path, perms) 89}

1. adviceLine 12

   The first argument can be controlled by an attacker. Do not use this function in security relevant contexts