Fix config includes and CodeQL findings

Author: eldryoth

docs/build-and-podman.md

@@ -332,10 +332,10 @@ root = "/srv/sites/example/public"
 For multi-site setups, prefer `/etc/fluxheim/conf.d/` with one vhost per file.
 `[[vhosts]]` starts a vhost, and each following `[vhosts.*]` table belongs to
 that vhost until the next `[[vhosts]]`.
-When Fluxheim starts from `/etc/fluxheim/fluxheim.toml`, it also loads visible
-`*.toml` files from `/etc/fluxheim/conf.d/` after the main file. When it starts
-from `/etc/fluxheim`, it loads top-level TOML files first and then
-`/etc/fluxheim/conf.d/*.toml`.
+The packaged `/etc/fluxheim/fluxheim.toml` sets `include_conf_d = true`, so it
+also loads visible `*.toml` files from `/etc/fluxheim/conf.d/` after the main
+file. When Fluxheim starts from `/etc/fluxheim`, it loads top-level TOML files
+first and then `/etc/fluxheim/conf.d/*.toml`.
 
 Podman run example:
 

docs/config-reference.md

@@ -15,11 +15,12 @@ For split config directories, Fluxheim reads `*.toml` files in sorted order:
 fluxheim --check-config --config examples/conf.d
 ```
 
-When the config path is a file, Fluxheim loads that file first and then loads
-visible `*.toml` files from a sibling `conf.d/` directory if it exists. When
-the config path is a directory, Fluxheim loads visible `*.toml` files in that
-directory first and then visible `*.toml` files in its `conf.d/` child. Files
-are loaded in lexical order within each directory.
+When the config path is a file, Fluxheim loads only that file unless the file
+sets `include_conf_d = true`. With that opt-in, visible `*.toml` files from a
+sibling `conf.d/` directory load after the main file. When the config path is a
+directory, Fluxheim loads visible `*.toml` files in that directory first and
+then visible `*.toml` files in its `conf.d/` child. Files are loaded in lexical
+order within each directory.
 
 Relative filesystem paths are resolved from the config file directory.
 Config sources must be real TOML files or real directories. Fluxheim rejects a

packaging/default/fluxheim.toml

@@ -1,3 +1,5 @@
+include_conf_d = true
+
 [server]
 listen = ["0.0.0.0:80"]
 default_vhost = "default"

scripts/build_fluxheim_rpm.py

@@ -15,7 +15,6 @@
 import sys
 import tempfile
 from pathlib import Path
-from typing import Sequence
 
 
 OS_CONTAINERS = {
@@ -31,11 +30,6 @@
 SAFE_RPM_RELEASE = re.compile(r"^[0-9][0-9A-Za-z._+~]*$")
 
 
-def run_command(command: Sequence[str], cwd: Path | None = None) -> None:
-    print(f"Executing: {shlex.join(command)}")
-    subprocess.run(command, cwd=cwd, check=True)
-
-
 def get_container_tool(preferred: str | None) -> str:
     if preferred:
         if shutil.which(preferred):
@@ -92,6 +86,50 @@ def print_targets() -> None:
         print(f"{name}: {image}")
 
 
+def run_container_build(
+    container_tool: str,
+    work_dir: Path,
+    container_image: str,
+    version_tag: str,
+    build_type: str,
+    rpm_release: str,
+) -> None:
+    print(
+        "Executing: "
+        + shlex.join(
+            [
+                container_tool,
+                "run",
+                "--rm",
+                "-v",
+                f"{work_dir}:/workspace:Z",
+                container_image,
+                "bash",
+                "/workspace/build_in_container.sh",
+                version_tag,
+                build_type,
+                rpm_release,
+            ]
+        )
+    )
+    subprocess.run(
+        [
+            container_tool,
+            "run",
+            "--rm",
+            "-v",
+            f"{work_dir}:/workspace:Z",
+            container_image,
+            "bash",
+            "/workspace/build_in_container.sh",
+            version_tag,
+            build_type,
+            rpm_release,
+        ],
+        check=True,
+    )
+
+
 def choose_target(target: str | None) -> tuple[str, str]:
     if target:
         return target, OS_CONTAINERS[target]
@@ -325,20 +363,13 @@ def main() -> int:
         generate_build_script(build_script_path)
         build_script_path.chmod(0o755)
 
-        run_command(
-            [
-                container_tool,
-                "run",
-                "--rm",
-                "-v",
-                f"{work_dir}:/workspace:Z",
-                container_image,
-                "bash",
-                "/workspace/build_in_container.sh",
-                args.version_tag,
-                args.build_type,
-                args.rpm_release,
-            ]
+        run_container_build(
+            container_tool,
+            work_dir,
+            container_image,
+            args.version_tag,
+            args.build_type,
+            args.rpm_release,
         )
 
         rpms = sorted(work_dir.glob("*.rpm"))

src/config.rs

@@ -70,14 +70,15 @@ impl Config {
 
     fn load_file(path: &Path) -> Result<Self, ConfigLoadError> {
         let mut fragment = ConfigFragment::load(path)?;
+        let include_conf_d = fragment.include_conf_d;
         let parent = path.parent();
         if let Some(parent) = parent {
             fragment.resolve_relative_paths(parent);
         }
 
         let mut config = Self::default();
         config.merge(fragment);
-        if let Some(parent) = parent {
+        if include_conf_d && let Some(parent) = parent {
             config.merge_conf_d(parent)?;
         }
         Ok(config)
@@ -225,6 +226,8 @@ impl Config {
 #[derive(Debug, Clone, Default, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
 struct ConfigFragment {
+    #[serde(default)]
+    include_conf_d: bool,
     #[serde(default)]
     server: Option<ServerConfigFragment>,
     #[serde(default)]
@@ -7065,6 +7068,8 @@ mod tests {
         fs::write(
             dir.child("fluxheim.toml"),
             r#"
+            include_conf_d = true
+
             [server]
             listen = ["127.0.0.1:19090"]
             default_vhost = "example"
@@ -7091,6 +7096,33 @@ mod tests {
         assert_eq!(config.vhosts[0].web.root, Some(dir.child("conf.d/site")));
     }
 
+    #[test]
+    fn loading_main_config_file_does_not_load_conf_d_without_opt_in() {
+        let dir = TestDir::new("config-file-with-conf-d-no-opt-in");
+        fs::create_dir_all(dir.child("conf.d")).unwrap();
+        fs::write(
+            dir.child("fluxheim.toml"),
+            r#"
+            [server]
+            listen = ["127.0.0.1:19090"]
+            "#,
+        )
+        .unwrap();
+        fs::write(
+            dir.child("conf.d/10-vhost.toml"),
+            r#"
+            [[vhosts]]
+            name = "example"
+            hosts = ["example.test"]
+            "#,
+        )
+        .unwrap();
+
+        let config = Config::load(Some(&dir.child("fluxheim.toml"))).unwrap();
+
+        assert!(config.vhosts.is_empty());
+    }
+
     #[test]
     fn loading_config_directory_also_loads_conf_d_after_top_level_files() {
         let dir = TestDir::new("config-dir-with-conf-d");

src/web.rs

@@ -301,24 +301,18 @@ fn normal_component(component: &std::ffi::OsStr) -> Option<&std::ffi::OsStr> {
     }
 }
 
-fn symlink_walk_status(path: &Path) -> io::Result<Option<bool>> {
-    if path.is_symlink() {
-        return Ok(Some(true));
-    }
-    path.try_exists().map(|exists| exists.then_some(false))
-}
-
 fn path_contains_symlink(root: &Path, relative: &SafeRelativePath) -> io::Result<bool> {
     let mut current = root.to_path_buf();
     for component in &relative.components {
         let Some(component) = normal_component(component) else {
             return Ok(true);
         };
         current.push(component);
-        match symlink_walk_status(&current)? {
-            Some(true) => return Ok(true),
-            Some(false) => {}
-            None => return Ok(false),
+        match std::fs::read_link(&current) {
+            Ok(_) => return Ok(true),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(false),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput => {}
+            Err(error) => return Err(error),
         }
     }
 
@@ -340,10 +334,11 @@ fn configured_web_path_contains_symlink(path: &Path) -> io::Result<bool> {
             }
             std::path::Component::CurDir | std::path::Component::ParentDir => return Ok(true),
         }
-        match symlink_walk_status(&current)? {
-            Some(true) => return Ok(true),
-            Some(false) => {}
-            None => return Ok(false),
+        match std::fs::read_link(&current) {
+            Ok(_) => return Ok(true),
+            Err(error) if error.kind() == io::ErrorKind::NotFound => return Ok(false),
+            Err(error) if error.kind() == io::ErrorKind::InvalidInput => {}
+            Err(error) => return Err(error),
         }
     }