RELNOTES[INC]: It is now an error for a cc rule's includes attribute to point to the workspace root.

--
MOS_MIGRATED_REVID=119558172

2 files changed, 24 insertions, 1 deletions

diff --git a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
index b1639ea9a2..69763d4513 100644
--- a/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
+++ b/src/main/java/com/google/devtools/build/lib/rules/cpp/CcCommon.java
@@ -408,7 +408,15 @@ public final class CcCommon {
         ruleContext.attributeError("includes",
             "Path references a path above the execution root.");
       }
-      if (!includesPath.startsWith(packageFragment)) {
+      if (includesPath.segmentCount() == 0) {
+        ruleContext.attributeError(
+            "includes",
+            "'"
+                + includesAttr
+                + "' resolves to the workspace root, which would allow this rule and all of its "
+                + "transitive dependents to include any file in your workspace. Please include only"
+                + " what you need");
+      } else if (!includesPath.startsWith(packageFragment)) {
         ruleContext.attributeWarning(
             "includes",
             "'"
diff --git a/src/test/java/com/google/devtools/build/lib/rules/cpp/CcCommonConfiguredTargetTest.java b/src/test/java/com/google/devtools/build/lib/rules/cpp/CcCommonConfiguredTargetTest.java
index 582400a740..abf21165dd 100644
--- a/src/test/java/com/google/devtools/build/lib/rules/cpp/CcCommonConfiguredTargetTest.java
+++ b/src/test/java/com/google/devtools/build/lib/rules/cpp/CcCommonConfiguredTargetTest.java
@@ -519,6 +519,21 @@ public class CcCommonConfiguredTargetTest extends BuildViewTestCase {
   }
 
   @Test
+  public void testCcLibraryRootIncludesError() throws Exception {
+    checkError(
+        "root",
+        "lib",
+        // message:
+        "in includes attribute of cc_library rule //root:lib: '..' resolves to the workspace root, "
+            + "which would allow this rule and all of its transitive dependents to include any "
+            + "file in your workspace. Please include only what you need",
+        // build file:
+        "cc_library(name = 'lib',",
+        "           srcs = ['foo.cc'],",
+        "           includes = ['..'])");
+  }
+
+  @Test
   public void testStaticallyLinkedBinaryNeedsSharedObject() throws Exception {
     scratch.file(
         "third_party/sophos_av_pua/BUILD",