Force PATH isolation: FastGA can only see its own utilities

Author: ekg

src/ffi.rs

@@ -96,15 +96,15 @@ pub fn run_fastga_alignment(
     // Convert to raw pointers for C
     let c_args: Vec<*const c_char> = args.iter().map(|s| s.as_ptr()).collect();
 
-    // Set PATH to include our binary directory so FastGA can find FAtoGDB, GIXmake, etc.
+    // Set ISOLATED PATH so FastGA can ONLY find its own utilities (FAtoGDB, GIXmake, etc.)
+    // This prevents FastGA from accidentally using system binaries
     let bin_dir = find_fastga_bin_dir();
 
-    // Save original PATH
+    // Save original PATH for restoration
     let original_path = std::env::var("PATH").unwrap_or_default();
 
-    // Add our binary directory to PATH
-    let new_path = format!("{bin_dir}:{original_path}");
-    std::env::set_var("PATH", &new_path);
+    // Set PATH to ONLY our binary directory (isolated)
+    std::env::set_var("PATH", &bin_dir);
 
     // Create a pipe to capture stdout
     use std::io::Read;

src/runner.rs

@@ -38,17 +38,10 @@ impl Orchestrator {
         // Find FastGA binary
         let fastga = find_fastga_binary()?;
 
-        // Get binary directory and set up PATH so FastGA can find its helper utilities
+        // Get binary directory and set up ISOLATED PATH so FastGA can ONLY find its own utilities
+        // This prevents FastGA from accidentally using system binaries
         let binary_dir = crate::binary_finder::get_binary_dir()?;
-        let new_path = if let Some(old_path) = std::env::var_os("PATH") {
-            let mut paths = std::env::split_paths(&old_path).collect::<Vec<_>>();
-            // Prepend binary_dir to ensure it's found first
-            paths.insert(0, binary_dir.clone());
-            std::env::join_paths(paths).unwrap()
-        } else {
-            // No existing PATH, just use binary_dir
-            std::ffi::OsString::from(binary_dir.as_os_str())
-        };
+        let new_path = std::ffi::OsString::from(binary_dir.as_os_str());
 
         // FIX 1: Create unique temp directory for FastGA's internal files (GDB, indexes, etc.)
         // This prevents race conditions when multiple FastGA instances run in parallel

src/simple_runner.rs

@@ -139,10 +139,9 @@ pub fn run_fastga_simple(
     cmd.arg(query_path);
     cmd.arg(target_path);
 
-    // Set PATH to include binary directory
-    let current_path = std::env::var("PATH").unwrap_or_default();
-    let new_path = format!("{}:{}", bin_dir.display(), current_path);
-    cmd.env("PATH", new_path);
+    // Set ISOLATED PATH so FastGA can ONLY find its own utilities
+    // This prevents FastGA from accidentally using system binaries
+    cmd.env("PATH", bin_dir);
 
     eprintln!("[FastGA] Running command: {cmd:?}");
 
@@ -192,9 +191,8 @@ where
     cmd.arg(query_path);
     cmd.arg(target_path);
 
-    let current_path = std::env::var("PATH").unwrap_or_default();
-    let new_path = format!("{}:{}", bin_dir.display(), current_path);
-    cmd.env("PATH", new_path);
+    // Set ISOLATED PATH so FastGA can ONLY find its own utilities
+    cmd.env("PATH", bin_dir);
 
     let mut child = cmd
         .stdout(Stdio::piped())