From 95737d8101010d7de52e1b10dd8ba99dd87af8fc Mon Sep 17 00:00:00 2001
From: Abel Lucas <uaelucas@gmail.com>
Date: Wed, 18 Dec 2024 18:39:34 +0100
Subject: [PATCH] cache: do not trust the filesystem

---
 backend/windmill-common/src/cache.rs | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/backend/windmill-common/src/cache.rs b/backend/windmill-common/src/cache.rs
index 81043025c2a63..db019d6358a1d 100644
--- a/backend/windmill-common/src/cache.rs
+++ b/backend/windmill-common/src/cache.rs
@@ -279,6 +279,10 @@ const _: () = {
                 _ => Ok(None),
             }
         }
+
+        fn validate(&self) -> bool {
+            !self.code.is_empty()
+        }
     }
 
     impl fs::Bundle for ScriptMetadata {
@@ -684,6 +688,10 @@ mod fs {
         fn import(&mut self, item: Self::Item, data: Vec<u8>) -> error::Result<()>;
         /// Export the `item` into a `Vec<u8>`.
         fn export(&self, item: Self::Item) -> error::Result<Option<Vec<u8>>>;
+        /// Validate the bundle.
+        fn validate(&self) -> bool {
+            true
+        }
     }
 
     /// An item that can be imported/exported from/into the file-system.
@@ -716,7 +724,10 @@ mod fs {
                 Ok(data)
             };
             match import() {
-                Ok(data) => return Ok(data),
+                Ok(data) if data.validate() => return Ok(data),
+                Ok(_) => tracing::warn!(
+                    "Failed to import from file-system, invalid data, fetch source..: {path:?}"
+                ),
                 Err(err) => tracing::warn!(
                     "Failed to import from file-system, fetch source..: {path:?}: {err:?}"
                 ),
@@ -807,6 +818,10 @@ mod fs {
                 _ => Ok(None),
             }
         }
+
+        fn validate(&self) -> bool {
+            self.as_ref().map_or(true, T::validate)
+        }
     }
 
     // Bundle pair.
@@ -830,6 +845,10 @@ mod fs {
                 _ => self.1.export(item),
             }
         }
+
+        fn validate(&self) -> bool {
+            self.0.validate() && self.1.validate()
+        }
     }
 
     // Implement `Item`.