Only allow files created by the same rule as executable outputs of a rule.

Fixes #4170.

Change-Id: I308ee17eb769dcc6a94b90b1dd6cc2ccbe14e968
PiperOrigin-RevId: 182807196

2 files changed, 38 insertions, 0 deletions

diff --git a/src/main/java/com/google/devtools/build/lib/analysis/skylark/SkylarkRuleConfiguredTargetUtil.java b/src/main/java/com/google/devtools/build/lib/analysis/skylark/SkylarkRuleConfiguredTargetUtil.java
index a40bacb549..d22857e84d 100644
--- a/src/main/java/com/google/devtools/build/lib/analysis/skylark/SkylarkRuleConfiguredTargetUtil.java
+++ b/src/main/java/com/google/devtools/build/lib/analysis/skylark/SkylarkRuleConfiguredTargetUtil.java
@@ -387,6 +387,14 @@ public final class SkylarkRuleConfiguredTargetUtil {
         defaultRunfiles = cast("default_runfiles", provider, Runfiles.class, loc);
       } else if (field.equals("executable")) {
         executable = cast("executable", provider, Artifact.class, loc);
+        if (!executable.getArtifactOwner().equals(context.getRuleContext().getOwner())) {
+          throw new EvalException(
+              loc,
+              String.format(
+                  "'executable' provided by an executable rule '%s' should be created "
+                      + "by the same rule.",
+                  context.getRuleContext().getRule().getRuleClass()));
+        }
       } else if (provider
           .getProvider()
           .getKey()
diff --git a/src/test/java/com/google/devtools/build/lib/skylark/SkylarkIntegrationTest.java b/src/test/java/com/google/devtools/build/lib/skylark/SkylarkIntegrationTest.java
index 0cdef5bdd5..40500e66b6 100644
--- a/src/test/java/com/google/devtools/build/lib/skylark/SkylarkIntegrationTest.java
+++ b/src/test/java/com/google/devtools/build/lib/skylark/SkylarkIntegrationTest.java
@@ -1567,6 +1567,36 @@ public class SkylarkIntegrationTest extends BuildViewTestCase {
         + "parameter to the DefaultInfo it returns.");
   }
 
+  @Test
+  public void testExecutableFromDifferentRuleIsForbidden() throws Exception {
+    scratch.file(
+        "pkg/BUILD",
+        "sh_binary(name = 'tryme',",
+        "          srcs = [':tryme.sh'],",
+        "          visibility = ['//visibility:public'],",
+        ")");
+
+    scratch.file(
+        "src/rulez.bzl",
+        "def  _impl(ctx):",
+        "   return [DefaultInfo(executable = ctx.executable.runme,",
+        "                       files = depset([ctx.executable.runme]),",
+        "          )]",
+        "r = rule(_impl,",
+        "         executable = True,",
+        "         attrs = {",
+        "            'runme' : attr.label(executable = True, mandatory = True, cfg = 'host'),",
+        "         }",
+        ")");
+
+    scratch.file(
+        "src/BUILD", "load(':rulez.bzl', 'r')", "r(name = 'r_tools', runme = '//pkg:tryme')");
+    reporter.removeHandler(failFastHandler);
+    getConfiguredTarget("//src:r_tools");
+    assertContainsEvent(
+        "/workspace/src/rulez.bzl:2:12: 'executable' provided by an executable"
+            + " rule 'r' should be created by the same rule.");
+  }
 
   /**
    * Skylark integration test that forces inlining.