Skip to content

Clearly error when ownership check fails when walking parent directories to find a Taskfile #1683

@deviantintegral

Description

@deviantintegral

I ran into a tricky issue where Task wasn't finding an expected Taskfile: https://github.com/orgs/ddev/discussions/6273

What was confusing to me is that https://taskfile.dev/next/usage/#running-a-taskfile-from-a-subdirectory says

it will walk up the file tree until it finds one (similar to how git works)

I think it's common for this to refer to git not crossing mounted file systems when looking for a .git directory. It wasn't clear to me that this would also involve ownership checks, which is done here:

task/taskfile/taskfile.go

Lines 148 to 150 in 40d7715

// Error if we reached the root directory and still haven't found a file
// OR if the user id of the directory changes
if path == parentPath || (parentOwner != owner) {

I assume this is all to prevent potential security issues like the one in Git https://github.blog/2022-04-12-git-security-vulnerability-announced/.

It'd be great if Task could either:

  • Clearly say why it stopped walking parent directories.
  • Or, if we don't need to check ownership then don't.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: readerChanges related to the Taskfile reader.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions