Allow banning symlink action outputs from being uploaded to a remote cache.

This is mostly a roll-forward of 4465dae23de989f1452e93d0a88ac2a289103dd9, which
was reverted by fa36d2f48965b127e8fd397348d16e991135bfb6. The main difference is
that the new behavior is now gated behind the --noremote_allow_symlink_upload
flag.

https://docs.google.com/document/d/1gnOYszitgrLVet3sQk-TKGqIcpkkDsc6aw-izoo-d64
is a design proposal to support symlinks in the remote cache, which would render
this change moot. I'd like to be able to prevent incorrect cache behavior until
that change is implemented, though.

This fixes https://github.com/bazelbuild/bazel/issues/4840 (again).

Closes #5122.

Change-Id: I2136cfe82c2e1a8a9f5856e12a37d42cabd0e299
PiperOrigin-RevId: 195261827

2 files changed, 68 insertions, 0 deletions

diff --git a/src/test/shell/bazel/remote/remote_execution_http_test.sh b/src/test/shell/bazel/remote/remote_execution_http_test.sh
index fa21adab53..215ea74219 100755
--- a/src/test/shell/bazel/remote/remote_execution_http_test.sh
+++ b/src/test/shell/bazel/remote/remote_execution_http_test.sh
@@ -127,6 +127,56 @@ EOF
   fi
 }
 
+function test_refuse_to_upload_symlink() {
+    cat > BUILD <<'EOF'
+genrule(
+    name = 'make-link',
+    outs = ['l', 't'],
+    cmd = 'touch $(location t) && ln -s t $(location l)',
+)
+EOF
+    bazel build \
+          --genrule_strategy=remote \
+          --noremote_allow_symlink_upload \
+          --remote_http_cache=http://localhost:${hazelcast_port}/hazelcast/rest/maps \
+          //:make-link &> $TEST_log \
+          && fail "should have failed" || true
+    expect_log "/l is a symbolic link"
+
+    bazel build \
+          --experimental_remote_spawn_cache \
+          --noremote_allow_symlink_upload \
+          --remote_http_cache=http://localhost:${hazelcast_port}/hazelcast/rest/maps \
+          //:make-link &> $TEST_log \
+          && fail "should have failed" || true
+    expect_log "/l is a symbolic link"
+}
+
+function test_refuse_to_upload_symlink_in_directory() {
+    cat > BUILD <<'EOF'
+genrule(
+    name = 'make-link',
+    outs = ['dir'],
+    cmd = 'mkdir $(location dir) && touch $(location dir)/t && ln -s t $(location dir)/l',
+)
+EOF
+    bazel build \
+          --genrule_strategy=remote \
+          --noremote_allow_symlink_upload \
+          --remote_http_cache=http://localhost:${hazelcast_port}/hazelcast/rest/maps \
+          //:make-link &> $TEST_log \
+          && fail "should have failed" || true
+    expect_log "dir/l is a symbolic link"
+
+    bazel build \
+          --experimental_remote_spawn_cache \
+          --noremote_allow_symlink_upload \
+          --remote_http_cache=http://localhost:${hazelcast_port}/hazelcast/rest/maps \
+          //:make-link &> $TEST_log \
+          && fail "should have failed" || true
+    expect_log "dir/l is a symbolic link"
+}
+
 function set_directory_artifact_testfixtures() {
   mkdir -p a
   cat > a/BUILD <<'EOF'
diff --git a/src/test/shell/bazel/remote/remote_execution_test.sh b/src/test/shell/bazel/remote/remote_execution_test.sh
index 277b882c6d..ecbddb6532 100755
--- a/src/test/shell/bazel/remote/remote_execution_test.sh
+++ b/src/test/shell/bazel/remote/remote_execution_test.sh
@@ -34,6 +34,7 @@ function set_up() {
         --work_path="${work_path}" \
         --listen_port=${worker_port} \
         --cas_path=${cas_path} \
+        --noremote_allow_symlink_upload \
         --pid_file="${pid_file}" >& $TEST_log &
     local wait_seconds=0
     until [ -s "${pid_file}" ] || [ "$wait_seconds" -eq 15 ]; do
@@ -522,6 +523,23 @@ EOF
   expect_log "Remote connection/protocol failed"
 }
 
+function test_refuse_symlink_output() {
+    cat > BUILD <<'EOF'
+genrule(
+    name = 'make-link',
+    outs = ['l', 't'],
+    cmd = 'touch $(location t) && ln -s t $(location l)',
+)
+EOF
+
+    bazel build \
+          --genrule_strategy=remote \
+          --remote_executor=localhost:${worker_port} \
+          //:make-link >& TEST_log \
+          && fail "should have failed"# || true
+    expect_log "/l is a symbolic link"
+}
+
 # TODO(alpha): Add a test that fails remote execution when remote worker
 # supports sandbox.