Merge pull request #3143 from itowlson/forbid-or-warn-on-dubious-file-paths

Warn or error on dubious-looking file mount

Author: itowlson

Cargo.lock

@@ -21,6 +21,7 @@ spin-locked-app = { path = "../locked-app" }
 spin-manifest = { path = "../manifest" }
 spin-serde = { path = "../serde" }
 tempfile = { workspace = true }
+terminal = { path = "../terminal" }
 tokio = { workspace = true }
 toml = { workspace = true }
 tracing = { workspace = true }

crates/loader/Cargo.toml

@@ -485,6 +485,20 @@ impl LocalLoader {
         dest_root: &Path,
         exclude_files: &[String],
     ) -> Result<()> {
+        if glob_or_path == ".." || glob_or_path.ends_with("/..") {
+            bail!("A file pattern can't end in a parent directory path (..)\nIf you want to include a directory, use source-destination form, or a glob pattern ending in **/*.\nLearn more: https://spinframework.dev/writing-apps#including-files-with-components");
+        }
+        if glob_or_path == "." || glob_or_path.ends_with("/.") {
+            bail!("A file pattern can't end in a current directory path (.)\nIf you want to include a directory, use source-destination form, or a glob pattern ending in **/*.\nLearn more: https://spinframework.dev/writing-apps#including-files-with-components");
+        }
+
+        if glob_or_path == "*" {
+            tracing::warn!(alert_in_dev = true, "A component is including the entire application directory as asset files. This is unlikely to be what you want.\nIf this is what you want, use the pattern \"./*\" to avoid this warning.\nLearn more: https://spinframework.dev/writing-apps#including-files-with-components\n");
+        }
+        if glob_or_path == "**/*" {
+            tracing::warn!(alert_in_dev = true, "A component is including the entire application directory tree as asset files. This is unlikely to be what you want.\nIf this is what you want, use the pattern \"./**/*\" to avoid this warning.\nLearn more: https://spinframework.dev/writing-apps#including-files-with-components\n");
+        }
+
         let path = self.app_root.join(glob_or_path);
         if path.exists() {
             let dest = dest_root.join(glob_or_path);

crates/loader/src/local.rs

@@ -0,0 +1,41 @@
+//! Provides a way for warnings to be force-raised in the
+//! `spin up` environment even if RUST_LOG is not set to warn.
+//! This is useful for things that are not errors but where we
+//! want application developers to know they have a problem.
+
+use tracing::{Event, Subscriber};
+use tracing_subscriber::{filter::filter_fn, registry::LookupSpan, Layer};
+
+const ALERT_IN_DEV_TAG: &str = "alert_in_dev";
+
+/// A layer which prints a terminal warning (using [terminal::warn!]) if
+/// a trace event contains the tag "alert_in_dev" (with any value).
+pub(crate) fn alert_in_dev_layer<S: Subscriber + for<'span> LookupSpan<'span> + 'static>(
+) -> impl Layer<S> {
+    CommandLineAlertingLayer.with_filter(filter_fn(|meta| {
+        meta.fields().field(ALERT_IN_DEV_TAG).is_some()
+    }))
+}
+
+pub struct CommandLineAlertingLayer;
+
+impl<S: Subscriber> Layer<S> for CommandLineAlertingLayer {
+    fn on_event(&self, event: &Event<'_>, _ctx: tracing_subscriber::layer::Context<'_, S>) {
+        warn(event);
+    }
+}
+
+fn warn(event: &Event<'_>) {
+    let mut visitor = PrintMessageAsWarning;
+    event.record(&mut visitor);
+}
+
+struct PrintMessageAsWarning;
+
+impl tracing::field::Visit for PrintMessageAsWarning {
+    fn record_debug(&mut self, field: &tracing::field::Field, value: &dyn std::fmt::Debug) {
+        if field.name() == "message" {
+            terminal::warn!("{value:?}");
+        }
+    }
+}

crates/telemetry/src/alert_in_dev.rs

@@ -7,6 +7,7 @@ use env::otel_tracing_enabled;
 use opentelemetry_sdk::propagation::TraceContextPropagator;
 use tracing_subscriber::{fmt, prelude::*, registry, EnvFilter, Layer};
 
+mod alert_in_dev;
 pub mod detector;
 mod env;
 pub mod logs;
@@ -83,11 +84,14 @@ pub fn init(spin_version: String) -> anyhow::Result<()> {
         None
     };
 
+    let alert_in_dev_layer = alert_in_dev::alert_in_dev_layer();
+
     // Build a registry subscriber with the layers we want to use.
     registry()
         .with(otel_tracing_layer)
         .with(otel_metrics_layer)
         .with(fmt_layer)
+        .with(alert_in_dev_layer)
         .init();
 
     // Used to propagate trace information in the standard W3C TraceContext format. Even if the otel