Skip to content

fix(report-converter): resolve symlink path traversals in plist parser (#3645) - #5131

Open
UOWISSS wants to merge 2 commits into
Ericsson:masterfrom
UOWISSS:fix-issue-3645
Open

UOWISSS wants to merge 2 commits into
Ericsson:masterfrom
UOWISSS:fix-issue-3645

Conversation

@UOWISSS

@UOWISSS UOWISSS commented Oct 6, 2026

Copy link
Copy Markdown

Summary

Closes #3645.

When source files are included or located via paths that traverse backwards (..) through a symbolic link directory, purely lexical normalization (os.path.normpath) incorrectly strips the directory name rather than stepping back from the physical symlink target. This leads to broken paths, causing CodeChecker to report missing/changed source files and miss defects during parse.

Solution

  • Introduced a filesystem-aware resolve_path() helper function in codechecker_report_converter.util.
  • Replaced os.path.normpath with resolve_path in codechecker_report_converter.report.parser.plist.get_file_index_map.
  • Added unit tests in tools/report-converter/tests/unit/util/test_resolve_path.py covering:
    • Symlink directory resolution followed by parent directory traversal (..).
    • Fallback behavior for non-existent paths.
    • Safe handling of empty/none input strings.

os.path.normpath performs purely lexical normalization, which fails when
parent directory traversals ('..') follow a symbolic link. Use a
filesystem-aware resolver to locate source files correctly when symlinks
and relative traversals are combined.
@UOWISSS
UOWISSS requested a review from bruntib as a code owner October 6, 2026 12:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

CodeChecker store compresses the paths without trying to resolve them first

1 participant