Dir.glob in configuration.rb vulnerable to bracket/brace characters in workspace path

[andriytyurnikov]

Description

RubyIndexer::Configuration#indexable_uris and #top_level_directories use Dir.glob with the workspace path interpolated into the pattern:

# indexable_uris (line 71)
Dir.glob(File.join(@workspace_path, pattern), flags)

# top_level_directories (line 268)
Dir.glob("#{Dir.pwd}/*")

If @workspace_path or Dir.pwd contains [, ], {, or }, these are interpreted as glob metacharacters rather than literal path characters.

Why this wasn't fixed in #4022

The natural fix is to use Dir.glob's base: parameter, which treats the base path literally:

Dir.glob(pattern, flags, base: @workspace_path)

However, this triggers a Ruby Dir.glob bug: when top_level_directories returns an empty array (e.g., in a minimal project with no subdirectories), the included pattern becomes "{}/**/*.rb". With the base: parameter, Dir.glob("{}/**/*.rb", base: dir) incorrectly traverses outside the base directory into system paths, causing Errno::EPERM on macOS protected directories. The joined-path form Dir.glob(File.join(dir, "{}/**/*.rb")) correctly returns [].

Possible approaches

• Guard against empty top_level_directories before constructing the pattern (avoid {} in glob)
• Use File.join but escape glob metacharacters in the workspace path portion with backslashes
• File a Ruby bug report for the Dir.glob base: + empty braces behavior

Impact

Low — workspace root paths rarely contain brackets or braces. This is a hardening issue rather than a user-facing bug.

[github-actions]

This issue is being marked as stale because there was no activity in the last 2 months

[andriytyurnikov]

This was auto-closed as stale, but it is still live and worth reopening — #4022 fixes the other Dir.glob call sites and deliberately leaves these two.

Confirming the impact. With a workspace at a path containing brackets, indexing finds nothing at all:

workspace: /tmp/.../[work]
Dir.glob(File.join(ws, "**/*.rb"), flags) # configuration.rb:71 today
# => []
Dir.glob("**/*.rb", base: ws) # what the other call sites now do
# => ["app/user.rb"]

So bracketed file names are fixed by #4022, but a bracketed workspace root still yields zero indexed files and therefore no working features at all.

Confirming the reason it was deferred, on Ruby 4.0.1. @included_patterns is built as "{#{top_level_directories.join(",")}}/**/*.rb", so an empty top_level_directories produces {}/**/*.rb. With base: that does not merely return nothing — it escapes the base directory and walks the file system from the root:

Dir.glob("{}/**/*.rb", flags, base: ws)
# => Errno::EPERM: Operation not permitted - /Library/Application Support/com.apple.TCC

Dir.glob(File.join(ws, "{}/**/*.rb"), flags) # joined form stays correctly scoped
# => [".../ws/app/user.rb"]

That is a genuinely bad failure mode for a language server, so the joined form is the right thing to keep until it is worked around.

Of the approaches listed in the description, guarding against an empty top_level_directories before building the pattern looks cheapest and removes the blocker on its own — the escaping approach would need the workspace path escaped for every pattern, and upstream is a slow path. Also worth noting the second site, top_level_directories at line 268, uses Dir.glob("#{Dir.pwd}/*") and has the same exposure.