fix(realpath): reject non-directory path components and forcing them to ENOTDIR by Martell0x1 · Pull Request #16153 · uutils/coreutils

Martell0x1 · 2026-11-03T01:46:32Z

Problem

uutils realpath incorrectly accepts paths containing a regular file followed by ...

For example, /tmp/example/file/.. succeeds in uutils, whereas GNU realpath fails with ENOTDIR (Not a directory).

The implementation removes the preceding component when encountering ParentDir without verifying that the component is a directory.

Root Cause

In src/uucore/src/lib/features/fs.rs, the ParentDir branch performs:

OwningComponent::ParentDir => {
    result.pop();
}

This removes the preceding component without validating whether it can be traversed as a directory.

Fix

Validate path components before resolving ParentDir, rejecting non-directory and nonexistent intermediate components where required by the selected resolution mode.

Tests

Added regression tests covering invalid file/parent-directory traversal and valid directory/parent-directory traversal.
Tested against the realpath feature:

cargo test --no-default-features --features realpath

Manually verified behavior using regular files, directories, and symlinks.

Requires #16161
Closes #16117

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

codspeed · 2026-11-03T04:09:03Z

Merging this PR will not alter performance

1 warning, 1 note

⚠️ 123 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

ℹ️ 1 benchmark has no flamegraph

The flamegraph wasn't generated: most of the time was spent in runtime internals, which would leave nothing useful to analyze.

See affected benchmarks

✅ 401 untouched benchmarks
⏩ 70 skipped benchmarks¹

_{Comparing Martell0x1:fix/realpath-parent-dir-not-directory (3cc5e18) with main (f1ae8f1)}

70 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

Martell0x1 · 2026-11-03T09:21:03Z

@codspeedbot explain why performance improved

sylvestre · 2026-11-03T10:45:23Z

            OwningComponent::CurDir => {}
            OwningComponent::ParentDir => {
+                // checking for current component
+                if !result.as_os_str().is_empty() {


this also runs with MissingHandling::Missing, so realpath -m missing/.. and -m file/.. fail now, GNU accepts both
please skip the check in that mode and add a -m test

ignored the check for MissingHandler::Missing

sylvestre · 2026-11-03T10:45:30Z

+                        Ok(meta) if meta.is_dir() => {}
+                        Ok(_) => {
+                            return Err(Error::new(ErrorKind::NotADirectory, "Not a directory"));
+                        }


why rebuild a NotFound error? Err(e) => return Err(e) is enough

sylvestre · 2026-11-03T10:45:32Z

            OwningComponent::CurDir => {}
            OwningComponent::ParentDir => {
+                // checking for current component
+                if !result.as_os_str().is_empty() {


could you please reuse ensure_is_directory(&result)? here? it already gives ENOTDIR, without the hardcoded strings

sylvestre · 2026-11-03T10:45:36Z


 // spell-checker:ignore nusr

+use uucore::util_name;


util_name is already imported from uutests, does this compile?

actually it did , i guess as rust allows importing the same macro's name but from different paths

sylvestre · 2026-11-03T10:45:40Z

+        .ucmd()
+        .arg("regular_file/..")
+        .fails()
+        .code_is(1)


the issue also mentions -L, -e and readlink -f, please add tests for them
-L still goes through normalize_path, so it isn't fixed yet

yes i totaly forgot to add Logical path support .

sylvestre · 2026-11-03T10:45:43Z

+
+    at.mkdir("directory");
+
+    scene.ucmd().arg("directory/..").succeeds();


please check the stdout too, not only the exit code

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

…ically

…ng mode and fixed tests

Copilot

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing. Review the Copilot code review billing settings.

Copilot AI balanced review requested due to automatic review settings November 3, 2026 01:46

Copilot AI reviewed Nov 3, 2026

Martell0x1 force-pushed the fix/realpath-parent-dir-not-directory branch from 2f1fa3d to 3cc5e18 Compare November 3, 2026 09:12

Copilot AI balanced review requested due to automatic review settings November 3, 2026 09:12

Copilot AI reviewed Nov 3, 2026

sylvestre reviewed Nov 3, 2026

View reviewed changes

Copilot AI balanced review requested due to automatic review settings November 3, 2026 14:26

Copilot AI reviewed Nov 3, 2026

Martell0x1 requested a review from sylvestre November 3, 2026 14:31

Martell0x1 added 3 commits November 3, 2026 16:38

fix: Applied physical directory checks so realpath doen't resolve lex…

e14d781

…ically

fix: fixed physical directory component , ignored the check for missi…

463b6eb

…ng mode and fixed tests

fix(realpath): validate directory before resolving parent components

8fbaeb1

Martell0x1 force-pushed the fix/realpath-parent-dir-not-directory branch from e7c8a6b to 8fbaeb1 Compare November 3, 2026 14:39

Copilot AI balanced review requested due to automatic review settings November 3, 2026 14:39

Copilot AI reviewed Nov 3, 2026


		at.mkdir("directory");

		scene.ucmd().arg("directory/..").succeeds();

Conversation

Martell0x1 commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Root Cause

Fix

Tests

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

codspeed Bot commented Nov 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Martell0x1 commented Nov 3, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Martell0x1 commented Nov 3, 2026 •

edited

Loading

codspeed Bot commented Nov 3, 2026 •

edited

Loading