fix(organize): reject sources outside install dir
Metadata
Current evaluation
Merged fix preventing the organize step from processing sources outside the part install directory. Blocks absolute paths and directory traversal while preserving symlink behavior. Unrelated CI failures did not block the merge.
Suggested action: —
No scores available.
Issue body
## Summary
Reject `organize` source entries that resolve outside the part install directory.
This fixes cases where `organize` could read from absolute paths or use directory traversal to escape the install directory.
## Testing
- `ruff check craft_parts/executor/organize.py tests/unit/executor/test_organize.py tests/unit/features/partitions/executor/test_organize.py`
- `pytest -q tests/unit/executor/test_organize.py -rs`
- `pytest -q tests/unit/features/partitions/executor/test_organize.py -rs`
## Notes
This keeps normalized in-tree paths working, such as `dir/../foo`, while rejecting absolute and escaping source paths.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged fix preventing the organize step from processing sources outside the part install directory. Blocks absolute paths and directory traversal while preserving symlink behavior. Unrelated CI failures did not block the merge. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
40
Complexity:
30
Confidence:
90
|
needs review | Fixes organize to reject absolute or directory-traversing source paths outside the install directory. Validation updated to preserve symlink behavior. Currently awaiting resolution of unrelated CI failures for OSV scanner and Java plugins. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #689 fix(organize): use the part's install directories | craft-parts | merged | Merged fix for organize_files() which incorrectly used relative paths, organizing files in cwd instead of base_dir. The function now accepts the part's install directories directly. Approved by two reviewers and passed CI. | |
| #1525 Directory traversal issue when organizing a part | craft-parts | closed | Fixed via PR #1562. Added validation to reject organize source paths escaping the part install directory, blocking directory traversal and absolute path misuse. Merged and closed. | |
| #690 fix(organize): use the part's install directories (#689) | craft-parts | merged | Merged fix for organize_files() using the current working directory instead of the project base directory. The function now accepts the part's install directories directly, eliminating relative path redefinition. |