Encode FilePath as a string or an array of code units
#181
Conversation
This changes the `FilePath`'s `Codable` conformance to encode and decode `FilePath` as a string or an array of code units instead of using the default synthesized implementation that encodes the storage directly. Decoding data as internal storage is not user-friendly and allows to construct invalid `FilePath` instances (e.g. with non-null-terminated storage). So, the new implementation tries to decode the input as a string first and then as an array of code units. If the array is not null-terminated, the decoding fails.
kateinoigakukun
requested review from
glessard,
lorentey and
milseman
as code owners
|
@swift-ci test |
|
Do we need to support decoding the old synthesized format? In that case, we continue exposing a way to construct an invalid FilePath, so I didn't include it in this PR. WDYT? |
|
IMO the It's also likely someone is already depending on the existing implementation (which is buggy in a way that could be a security issue), so I think while what you've done here is an improvement in many ways, it probably also needs to support the existing encoding — though we should check it carefully to make sure we don't allow the storage to be non-NUL-terminated. |
Yeah, it might become another security concern. I took a look at how other language ecosystems handle it:
Rust (serde) approach addresses the wrong use case you mentioned where serialization and deserialization happened on different platforms. I think it's worth doing a similar tagging when (de)serializing paths as code points.
Ok, it makes sense to me to accept the existing encoding only if the storage is valid 👍 |
|
Closing in favor of #189 |
This changes the
FilePath'sCodableconformance to encode and decodeFilePathas a string or an array of code units instead of using the default synthesized implementation that encodes the storage directly.Decoding data as internal storage is not user-friendly and allows to construct invalid
FilePathinstances (e.g. with non-null-terminated storage).So, the new implementation tries to decode the input as a string first and then as an array of code units. If the array is not null-terminated, the decoding fails.
Close #106