prog/analysis: prevent sandbox escaping files from entering s.files

[blackgnezdo]

It causes panic later in (*randGen).filename.

[dvyukov]

Did you mean to use "../file0"? Otherwise it does not trigger the problem.

[blackgnezdo]

Right, I wanted to get some extra coverage and when I used "..", the assertion fired. I frankly don't know what kind of assertions are best made here.

[dvyukov]

Do you have any indication that this is what actually caused the panics? Or it's just code analysis?
I mean this looks like a reasonable thing to do regardless, I just wonder if we know that this is the root cause.

[blackgnezdo]

Do you have any indication that this is what actually caused the panics? Or it's just code analysis?

A combination of clues: production code reported s.files to contain ../file (the reports I invalidated yesterday). Inserting the check into the single place where s.files was being mutated stopped the problem cold.

I mean this looks like a reasonable thing to do regardless, I just wonder if we know that this is the root cause.

Considering there's one place where s.files is changed, it has to be. Ideally I'd want a level of abstraction with some invariants instead of a dictionary that's being assigned to in one place and read in a different one.