runner: validate library_name to prevent path traversal (#9887)

Add xrt_path_or_error() to xrt_core::environment that enforces three
guards before constructing a path for dlopen:

  1. Reject empty strings.
  2. Reject absolute paths (catches a leading '/' or Windows drive/UNC).
  3. Normalize the relative path with lexically_normal() and reject any
     result that still contains '..', preventing traversal outside the
     XRT installation root.

The runner's create_cpu() now calls xrt_path_or_error(libname) instead
of blindly joining library_name from the recipe JSON to xilinx_xrt().
Any recipe-supplied value that escapes the XRT root throws at parse
time rather than silently loading an arbitrary shared library.

Signed-off-by: Soren Soe <2106410+stsoe@users.noreply.github.com>

Author: stsoe

src/runtime_src/core/common/module_loader.cpp

@@ -321,6 +321,26 @@ xilinx_xrt()
   return ::xilinx_xrt();
 }
 
+sfs::path
+xrt_path_or_error(const std::string& file)
+{
+  if (file.empty())
+    throw std::runtime_error("Invalid empty file name");
+
+  std::filesystem::path path {file};
+
+  // No absolute path
+  if (path.is_absolute())
+    throw std::runtime_error("Invalid path '" + path.string() + "' cannot be absolute");
+
+  // May not contain any ".." to escape xilinx_xrt
+  auto normalize = path.lexically_normal();
+  if (normalize.string().find("..") != std::string::npos)
+    throw std::runtime_error("Invalid path '" + normalize.string() + "' escapes xrt");
+
+  return xilinx_xrt() / normalize;
+}
+
 sfs::path
 platform_path(const std::string& file_name)
 {

src/runtime_src/core/common/module_loader.h

@@ -126,6 +126,25 @@ XRT_CORE_COMMON_EXPORT
 std::filesystem::path
 platform_path(const std::string& file_name);
 
+/**
+ * xrt_path() - Get XRT path to specified file
+ *
+ * @param file
+ *   Relative path to a file
+ * Return:
+ *   Path of file rooted at xilinx_xrt() or error
+ *
+ * This function can be used to limit on demand loading to
+ * files that are rooted at xilinx_xrt().
+ *
+ * Throws if file is an absolute path or if resulting path
+ * escapes xilinx_xrt().   Here escape simply implies that
+ * the resulting path contains any ".." element.
+ */
+XRT_CORE_COMMON_EXPORT
+std::filesystem::path
+xrt_path_or_error(const std::string& file);
+
 /**
  * platform_repo_paths() - Get paths to the platform repositories
  *

src/runtime_src/core/common/runner/runner.cpp

@@ -508,8 +508,8 @@ class recipe
       create_cpu(const json& j)
       {
         auto name = j.at("name").get<std::string>(); // required
-        auto library_path = xrt_core::environment::xilinx_xrt()
-          / j.at("library_name").get<std::string>(); // required
+        auto libname = j.at("library_name").get<std::string>(); // required
+        auto library_path = xrt_core::environment::xrt_path_or_error(libname);
         return cpu{std::move(name), library_path.string()};
       }