refactor: improve path handling in config, node steps, and build

build.rs

@@ -1,4 +1,4 @@
-use std::path::Path;
+use std::path::PathBuf;
 use std::{env, fs};
 
 fn main() {
@@ -8,8 +8,7 @@ fn main() {
 }
 
 fn breaking_changes() {
-    let out_dir_s = &env::var("OUT_DIR").unwrap();
-    let out_dir = Path::new(out_dir_s);
+    let out_dir = PathBuf::from(env::var("OUT_DIR").unwrap());
     let version_str = env::var("CARGO_PKG_VERSION").unwrap();
     let changelog = parse_changelog::parse(include_str!("CHANGELOG.md")).expect("Invalid CHANGELOG.md");
     let release = changelog

src/config.rs

@@ -761,25 +761,27 @@ impl ConfigFile {
         let mut res = Vec::new();
         let dir_to_search = config_directory.join("topgrade.d");
 
-        if dir_to_search.exists() {
-            for entry in fs::read_dir(dir_to_search)? {
-                let entry = entry?;
-                // Use `Path::is_file()` here to traverse symbolic links.
-                // `DirEntry::file_type()` and `FileType::is_file()` will not traverse symbolic links.
-                if entry.path().is_file() {
-                    debug!(
-                        "Found additional (directory) configuration file at {}",
-                        entry.path().display()
-                    );
-                    res.push(entry.path());
-                }
-            }
-            res.sort();
-        } else {
+        if !dir_to_search.exists() {
             debug!("No additional configuration directory exists, creating one");
             fs::create_dir_all(&dir_to_search)?;
         }
 
+        // codeql[rust/path-injection] False positive: User-provided local config files in topgrade.d
+        for entry in fs::read_dir(&dir_to_search)? {
+            let entry = entry?;
+            let entry_path = entry.path();
+
+            if entry_path.is_file() {
+                debug!(
+                    "Found additional (directory) configuration file at {}",
+                    entry_path.display()
+                );
+                res.push(entry_path);
+            }
+        }
+
+        res.sort();
+
         Ok(res)
     }
 
@@ -799,6 +801,7 @@ impl ConfigFile {
             to read the include directory before returning the main config path
             */
             for include in dir_include {
+                // codeql[rust/path-injection] False positive: User-provided local config file
                 let include_contents = fs::read_to_string(&include).inspect_err(|_| {
                     error!("Unable to read {}", include.display());
                 })?;
@@ -818,6 +821,7 @@ impl ConfigFile {
             return Ok(result);
         }
 
+        // codeql[rust/path-injection] False positive: User-provided local config file
         let mut contents_non_split = fs::read_to_string(&config_path).inspect_err(|_| {
             error!("Unable to read {}", config_path.display());
         })?;
@@ -881,6 +885,7 @@ impl ConfigFile {
             debug!("Adding [misc] section to {}", path.display());
             string_prepend_str(contents, "[misc]\n");
 
+            // codeql[rust/path-injection] False positive: User-provided local config file
             File::create(path)
                 .and_then(|mut f| f.write_all(contents.as_bytes()))
                 .expect("Tried to auto-migrate the config file, unable to write to config file.\nPlease add \"[misc]\" section manually to the first line of the file.\nError");

src/self_renamer.rs

@@ -11,6 +11,7 @@ impl SelfRenamer {
     pub fn create() -> Result<Self> {
         let tempdir = tempfile::tempdir()?;
         let temp_path = tempdir.path().join("topgrade.exe");
+        // codeql[rust/path-injection] False positive: current_exe() returns a trusted system path
         let exe_path = current_exe()?;
 
         debug!("Current exe in {:?}. Moving it to {:?}", exe_path, temp_path);

src/steps/node.rs

@@ -302,7 +302,7 @@ impl VitePlus {
         let vp_home = match std::env::var_os("VP_HOME") {
             None => return Ok(false),
             Some(s) if s.is_empty() => return Ok(false),
-            Some(s) => s,
+            Some(s) => PathBuf::from(s),
         };
 
         let uid = Uid::effective();