[2.5] Re-allow .install files containing '..'

master_changes.md

@@ -21,6 +21,7 @@ users)
 ## Config report
 
 ## Actions
+  * Stop the installation process via .install file from creating unnecessary intermediate directories for paths that contain `..` [#7015 @kit-ty-kate]
 
 ## Install
 
@@ -107,6 +108,7 @@ users)
 
 ## Reftests
 ### Tests
+  * Add a test showing the behaviour of .install files containing destination filepath trying to escape their scope [#6897 #7008 @rjbou @kit-ty-kate]
   * Add a test ensuring installing files through a .install file can't escape the opam switch (CVE-2026-57825) [#7005 @NathanReb]
 
 ### Engine
@@ -116,6 +118,7 @@ users)
 ## Doc
 
 ## Security fixes
+  * Invalidate .install fields containing absolute destination filepath except when in the `misc` field [#6897 #7008 @kit-ty-kate]
   * Fix a bug that allowed a package to install files anywhere on the system using a symlink to an external directory without warning the user and asking for their permission: CVE-2026-57825. [#7005 @NathanReb]
 
 # API updates

src/client/opamAction.ml

@@ -101,33 +101,33 @@ let preprocess_dot_install_t st nv build_dir =
           else
             (base, false) in
         let src_file = OpamFilename.create build_dir base.c in
-        let dst_file = match dst with
+        let unsafe_dst_file = match dst with
           | None   -> OpamFilename.create dst_dir (OpamFilename.basename src_file)
           | Some d ->
             if append && not (OpamFilename.Base.check_suffix d ".exe") then
               OpamFilename.create dst_dir
                 (OpamFilename.Base.add_extension d "exe")
             else
               OpamFilename.create dst_dir d in
+        let dst_file =
+          OpamFilename.of_string
+            (OpamSystem.real_path (OpamFilename.to_string unsafe_dst_file))
+        in
         let file = file_wo_prefix dst_file in
         let inst warning =
           if append then warning (OpamFilename.to_string src_file) `Add_exe;
           let check, warn = check ~src:build_dir ~dst:dst_dir base in
-          let real_dst =
-            OpamFilename.of_string
-              (OpamSystem.real_path (OpamFilename.to_string dst_file))
-          in
           let escapes =
-            not (OpamFilename.starts_with switch_prefix real_dst)
-            || (OpamFilename.starts_with switch_meta real_dst)
+            not (OpamFilename.starts_with switch_prefix dst_file)
+            || (OpamFilename.starts_with switch_meta dst_file)
           in
           if escapes then
             (OpamConsole.error
               "package %s attempted to install a file outside allowed \
                destination directories: %s -> %s."
               (OpamPackage.Name.to_string name)
-              (OpamFilename.to_string dst_file)
-              (OpamFilename.to_string real_dst);
+              (OpamFilename.to_string unsafe_dst_file)
+              (OpamFilename.to_string dst_file);
              failwith ".install file escaping allowed directories")
           else if check then
             OpamFilename.install ~warning ~exec ~src:src_file ~dst:dst_file ();

src/format/opamFile.ml

@@ -3730,9 +3730,7 @@ module Dot_installSyntax = struct
         (Pp.opt @@
          Pp.singleton -| Pp.V.string -| Pp.pp ~name:"rel-filename"
            (fun ~pos s ->
-              if OpamFilename.might_escape ~sep:`Unspecified s then
-                Pp.bad_format ~pos "%s references its parent directory." s
-              else if Filename.is_relative s then
+              if Filename.is_relative s then
                 OpamFilename.Base.of_string s
               else
                 Pp.bad_format ~pos "%s is an absolute filename." s)