{"record":{"id":"eefd55471e59f78f","repo":"jdx/mise","slug":"native-cargo-binary-path-must-stay-inside-the-arti","errorCode":null,"errorMessage":"native cargo binary path must stay inside the artifact: {}","messagePattern":"native cargo binary path must stay inside the artifact: (.+?)","errorType":"validation","errorClass":"eyre::Report","httpStatus":null,"severity":"critical","filePath":"src/backend/cargo/native_binstall.rs","lineNumber":1029,"sourceCode":"        if extract_dir.join(&candidate).is_dir() {\n            return format!(\"{candidate}/{{ bin }}{{ binary-ext }}\");\n        }\n    }\n    \"{ bin }{ binary-ext }\".to_string()\n}\n\nfn validate_native_bin_relative_path(path: &str) -> Result<PathBuf> {\n    let path = PathBuf::from(path);\n    if path.components().next().is_none() {\n        bail!(\"native cargo binary path is empty\");\n    }\n    if path.components().any(|component| {\n        matches!(\n            component,\n            Component::ParentDir | Component::Prefix(_) | Component::RootDir\n        )\n    }) {\n        bail!(\n            \"native cargo binary path must stay inside the artifact: {}\",\n            path.display()\n        );\n    }\n    Ok(path)\n}\n\nfn validate_native_bin_sources(pending: &[(PathBuf, PathBuf)]) -> Result<()> {\n    let mut sources = BTreeSet::new();\n    for (src, _) in pending {\n        if !sources.insert(src) {\n            bail!(\n                \"native cargo binary artifact maps multiple bins to {}\",\n                file::display_path(src)\n            );\n        }\n    }\n    Ok(())","sourceCodeStart":1011,"sourceCodeEnd":1047,"githubUrl":"https://github.com/jdx/mise/blob/6f52dcdf99e282ef7a7db68c81301fa4618d0f79/src/backend/cargo/native_binstall.rs#L1011-L1047","documentation":"validate_native_bin_relative_path() is a path-traversal guard: the resolved binary path inside a binstall artifact must consist only of normal components. Any `..` (ParentDir), leading `/` (RootDir), or Windows drive prefix means the copy source would escape the extraction directory, so mise refuses it.","triggerScenarios":"A binstall bin-dir template or artifact layout resolves to a path like `../evil`, `/usr/bin/tool`, or `C:\\tools\\tool.exe` — i.e. anything escaping the extracted archive — during native binstall installation.","commonSituations":"Malicious or compromised crate metadata trying to point the installer at files outside the artifact (CVE-style supply-chain attempt); benign cases where a template accidentally includes an absolute path or `..` segment.","solutions":["Do not install the crate; if it came from an untrusted source, audit the crate's binstall metadata for traversal attempts","Remove custom bin-dir template overrides containing absolute paths or `..` from your own mise config","Install from source via `cargo install` which does not use artifact paths"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# reject bin-dir templates containing traversal or absolute segments\n[[ \"$BIN_DIR\" =~ \\.\\. ]] || [[ \"$BIN_DIR\" == /* ]] && echo 'unsafe template' || echo ok","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never install cargo: tools from untrusted authors with binstall enabled","Audit custom bin-dir overrides for `..` or leading slashes","Watch mise security advisories for binstall metadata attacks"],"tags":["cargo-binstall","path-traversal","security","supply-chain"],"backgroundTag":"path-traversal-blocked","analyzedSha":"6f52dcdf99e282ef7a7db68c81301fa4618d0f79","analyzedAt":"2026-08-22T10:14:23.840Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}