Enforce no decorators in --config values

Author: Jon Gjengset

src/cargo/util/config/mod.rs

@@ -79,7 +79,7 @@ use cargo_util::paths;
 use curl::easy::Easy;
 use lazycell::LazyCell;
 use serde::Deserialize;
-use toml_edit::easy as toml;
+use toml_edit::{easy as toml, Item};
 use url::Url;
 
 mod de;
@@ -1184,6 +1184,10 @@ impl Config {
                 let doc: toml_edit::Document = arg.parse().with_context(|| {
                     format!("failed to parse value from --config argument `{}` as a dotted key expression", arg)
                 })?;
+                fn non_empty_decor(d: &toml_edit::Decor) -> bool {
+                    d.prefix().map_or(false, |p| !p.trim().is_empty())
+                        || d.suffix().map_or(false, |s| !s.trim().is_empty())
+                }
                 let ok = {
                     let mut got_to_value = false;
                     let mut table = doc.as_table();
@@ -1193,17 +1197,49 @@ impl Config {
                         if table.len() != 1 {
                             break;
                         }
-                        let (_, n) = table.iter().next().expect("len() == 1 above");
-                        if let Some(nt) = n.as_table() {
-                            table = nt;
-                        } else if n.is_inline_table() {
-                            bail!(
-                                "--config argument `{}` sets a value to an inline table, which is not accepted",
-                                arg,
-                            );
-                        } else {
-                            got_to_value = true;
-                            break;
+                        let (k, n) = table.iter().next().expect("len() == 1 above");
+                        match n {
+                            Item::Table(nt) => {
+                                if table.key_decor(k).map_or(false, non_empty_decor)
+                                    || non_empty_decor(nt.decor())
+                                {
+                                    bail!(
+                                        "--config argument `{}` \
+                                            includes non-whitespace decoration",
+                                        arg
+                                    )
+                                }
+                                table = nt;
+                            }
+                            Item::Value(v) if v.is_inline_table() => {
+                                bail!(
+                                    "--config argument `{}` \
+                                    sets a value to an inline table, which is not accepted",
+                                    arg,
+                                );
+                            }
+                            Item::Value(v) => {
+                                if non_empty_decor(v.decor()) {
+                                    bail!(
+                                        "--config argument `{}` \
+                                            includes non-whitespace decoration",
+                                        arg
+                                    )
+                                }
+                                got_to_value = true;
+                                break;
+                            }
+                            Item::ArrayOfTables(_) => {
+                                bail!(
+                                    "--config argument `{}` \
+                                    sets a value to an array of tables, which is not accepted",
+                                    arg,
+                                );
+                            }
+
+                            Item::None => {
+                                bail!("--config argument `{}` doesn't provide a value", arg)
+                            }
                         }
                     }
                     got_to_value

tests/testsuite/config_cli.rs

@@ -352,7 +352,7 @@ Expected `.` or `=`
     let config = ConfigBuilder::new().config_arg("").build_err();
     assert_error(
         config.unwrap_err(),
-        "--config argument `` was not a TOML dotted key expression (a.b.c = _)",
+        "--config argument `` was not a TOML dotted key expression (such as `build.jobs = 2`)",
     );
 }
 
@@ -364,7 +364,7 @@ fn too_many_values() {
         config.unwrap_err(),
         "\
 --config argument `a=1
-b=2` was not a TOML dotted key expression (a.b.c = _)",
+b=2` was not a TOML dotted key expression (such as `build.jobs = 2`)",
     );
 }
 
@@ -390,7 +390,29 @@ fn no_array_of_tables_values() {
         config.unwrap_err(),
         "\
 --config argument `[[a.b]]
-c = \"d\"` was not a TOML dotted key expression (a.b.c = _)",
+c = \"d\"` was not a TOML dotted key expression (such as `build.jobs = 2`)",
+    );
+}
+
+#[cargo_test]
+fn no_comments() {
+    // Disallow comments in dotted form.
+    let config = ConfigBuilder::new()
+        .config_arg("a.b = \"c\" # exactly")
+        .build_err();
+    assert_error(
+        config.unwrap_err(),
+        "\
+--config argument `a.b = \"c\" # exactly` includes non-whitespace decoration",
+    );
+
+    let config = ConfigBuilder::new()
+        .config_arg("# exactly\na.b = \"c\"")
+        .build_err();
+    assert_error(
+        config.unwrap_err(),
+        "\
+--config argument `# exactly\na.b = \"c\"` includes non-whitespace decoration",
     );
 }