Replace glob with fs::read_dir to avoid path escaping issues. (#2528)

Author: fnando

.gitignore

@@ -11,4 +11,6 @@ local.sh
 .stellar
 .zed
 node_modules/
-.DS_Store
+.DS_Store
+logs/
+ai-summary/

cmd/soroban-cli/src/commands/contract/alias/ls.rs

@@ -1,5 +1,6 @@
 use clap::Parser;
 use std::collections::HashMap;
+use std::ffi::OsStr;
 use std::fmt::Debug;
 use std::path::Path;
 use std::{fs, process};
@@ -23,12 +24,6 @@ pub enum Error {
     #[error(transparent)]
     Network(#[from] network::Error),
 
-    #[error(transparent)]
-    PatternError(#[from] glob::PatternError),
-
-    #[error(transparent)]
-    GlobError(#[from] glob::GlobError),
-
     #[error(transparent)]
     IoError(#[from] std::io::Error),
 }
@@ -57,57 +52,57 @@ impl Cmd {
         Ok(())
     }
 
-    fn read_from_config_dir(config_dir: &Path) -> Result<(), Error> {
-        let pattern = config_dir
-            .join("contract-ids")
-            .join("*.json")
-            .to_string_lossy()
-            .into_owned();
-
-        let paths = glob::glob(&pattern)?;
-        let mut found = false;
+    fn collect_aliases(config_dir: &Path) -> Result<HashMap<String, Vec<AliasEntry>>, Error> {
+        let contract_ids_dir = config_dir.join("contract-ids");
         let mut map: HashMap<String, Vec<AliasEntry>> = HashMap::new();
 
-        for path in paths {
-            let path = path?;
+        if !contract_ids_dir.is_dir() {
+            return Ok(map);
+        }
+
+        for entry in fs::read_dir(&contract_ids_dir)? {
+            let path = entry?.path();
+
+            if path.extension() != Some(OsStr::new("json")) {
+                continue;
+            }
 
             if let Some(alias) = path.file_stem() {
                 let alias = alias.to_string_lossy().into_owned();
-                let content = fs::read_to_string(path)?;
+                let content = fs::read_to_string(&path)?;
                 let data: alias::Data = serde_json::from_str(&content).unwrap_or_default();
 
-                for network_passphrase in data.ids.keys() {
-                    let network_passphrase = network_passphrase.clone();
-                    let contract = data
-                        .ids
-                        .get(&network_passphrase)
-                        .map(ToString::to_string)
-                        .unwrap_or_default();
+                for (network_passphrase, contract_id) in &data.ids {
                     let entry = AliasEntry {
                         alias: alias.clone(),
-                        contract,
+                        contract: contract_id.clone(),
                     };
 
-                    let list = map.entry(network_passphrase.clone()).or_default();
-
-                    list.push(entry.clone());
+                    map.entry(network_passphrase.clone())
+                        .or_default()
+                        .push(entry);
                 }
             }
         }
 
-        for network_passphrase in map.keys() {
-            if let Some(list) = map.clone().get_mut(network_passphrase) {
-                println!("ℹ️ Aliases available for network '{network_passphrase}'");
+        Ok(map)
+    }
+
+    fn read_from_config_dir(config_dir: &Path) -> Result<(), Error> {
+        let mut map = Self::collect_aliases(config_dir)?;
+        let mut found = false;
 
-                list.sort_by(|a, b| a.alias.cmp(&b.alias));
+        for (network_passphrase, list) in &mut map {
+            println!("ℹ️ Aliases available for network '{network_passphrase}'");
 
-                for entry in list {
-                    found = true;
-                    println!("{}: {}", entry.alias, entry.contract);
-                }
+            list.sort_by(|a, b| a.alias.cmp(&b.alias));
 
-                println!();
+            for entry in list.iter() {
+                found = true;
+                println!("{}: {}", entry.alias, entry.contract);
             }
+
+            println!();
         }
 
         if !found {
@@ -119,3 +114,49 @@ impl Cmd {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::fs;
+
+    fn write_alias(dir: &Path, name: &str, network: &str, contract: &str) {
+        let contract_ids_dir = dir.join("contract-ids");
+        fs::create_dir_all(&contract_ids_dir).unwrap();
+        let content = format!(r#"{{"ids":{{"{network}":"{contract}"}}}}"#);
+        fs::write(contract_ids_dir.join(format!("{name}.json")), content).unwrap();
+    }
+
+    #[test]
+    fn glob_metacharacters_in_config_dir_are_treated_as_literal() {
+        let tmp = tempfile::tempdir().unwrap();
+        let base = tmp.path();
+
+        // Sibling directories that would match the glob `[12]` if unescaped.
+        write_alias(&base.join("cfg1"), "alpha", "testnet", "CAAAA");
+        write_alias(&base.join("cfg2"), "beta", "testnet", "CBBBB");
+
+        // The literal directory whose name contains bracket metacharacters.
+        write_alias(&base.join("cfg[12]"), "gamma", "testnet", "CCCCC");
+
+        let map = Cmd::collect_aliases(&base.join("cfg[12]")).unwrap();
+
+        let aliases: Vec<&str> = map
+            .values()
+            .flat_map(|entries| entries.iter().map(|e| e.alias.as_str()))
+            .collect();
+
+        assert!(
+            aliases.contains(&"gamma"),
+            "should read alias from the literal directory"
+        );
+        assert!(
+            !aliases.contains(&"alpha"),
+            "should not read from sibling cfg1"
+        );
+        assert!(
+            !aliases.contains(&"beta"),
+            "should not read from sibling cfg2"
+        );
+    }
+}