---

id: 7a84c65c-d72c-46e0-ab96-2c43bdeb7b0d title: 'build: -o guard bypass via .. / symlink deletes parent or repo (data loss)' state: closed labels:

• kind:security assignees: [] milestone: null created: 2026-10-27T17:24:52.294202432Z updated: 2026-10-27T17:45:35.161333041Z

---

What

prepare_out protects the repo with a lexical path check:

• src/build.rs:1144 — absolute(out) only joins cwd (./.. are left in).
• guard: out_abs == repo_abs || repo_abs.starts_with(&out_abs).

Path::starts_with normalizes . but not .., so <repo>/.. passes the guard and remove_dir_all resolves through .. and deletes the parent directory.

Reproduced

mkdir -p /tmp/prep/repo && cd /tmp/prep/repo && git init -b main
echo keep > README.md && git add -A && git commit -m one
echo CANARY > /tmp/prep/keep.txt
hu13 build . -o ..

Observed: /tmp/prep/keep.txt, the repo's .git and all sources were deleted; repo/ was recreated empty and the build failed with Unable to read current working directory. A symlinked ancestor (-o /tmp/alias/src where alias -> repo) deletes repo contents the same way.

Impact

Data loss: a plausible -o .. typo or a bad build command wipes the checkout and its parent. The #67 guard explicitly claims to refuse ancestors.

Fix

• Lexically normalize out (resolve ./..) and canonicalize the deepest existing ancestor before any comparison.
• Compare resolved paths; refuse when resolved out equals the repo or contains it.
• Also refuse an in-repo out that contains tracked files (src/, .forge/) while keeping dist/ legal; or require it to be empty/gitignored.
• Tests: absolute parent, relative .., ../.., symlinked ancestor; assert a canary outside the output survives.