build: quote the RandomX path so the guard cannot be stepped around

The marker guard added in fd627b1 used $(RANDOMX_DIR) unquoted, so an
operator-supplied value that expands to anything other than one word
walked straight past it. With a glob matching two directories,
`[ -d $(RANDOMX_DIR) ]` became a two-argument test, died with
"unexpected operator" rather than answering, and short-circuited the
&& before the marker was ever looked for -- leaving `rm -rf` to run
against every match. A value holding a space or a `&&` broke the outer
test the same way and reported "already built", and an apostrophe made
the recipe unparseable. So the commit's claim to refuse any directory
lacking the marker was falsifiable.

Quote every use, and reject up front the values that cannot name one
directory: empty and / now refuse deliberately rather than by way of
the one-argument `[ -d ]` quirk that happened to catch them, and
whitespace and glob characters are refused outright because
src/Makefile interpolates the same value into -I and -L unquoted,
where neither survives. A relative value is refused too: it named a
different directory here than in src/, and cd'ing into it made the
later mkdir -p resolve against the new cwd, so the build landed in
randomx-build/randomx-build/build and cmake found nothing.

Verified against the recipe text as make expands it, with rm replaced
by an echo, over empty, /, globs matching one and two directories,
spaces, tabs, relative paths, symlinks, apostrophes, semicolons,
backticks and newlines, under both dash and bash: every run either
refuses with a message or passes rm exactly one argument, identical to
the path the guard tested.

1 files changed, 32 insertions, 8 deletions

diff --git a/Makefile b/Makefile
index 602c154..c891001 100644
--- a/Makefile
+++ b/Makefile
@@ -67,6 +67,21 @@ APPIMAGETOOL_SHA256 := ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3c
 # RANDOMX_DIR=... explicitly; the recipe below will still never delete a
 # directory that lacks the marker file this build writes after a successful
 # build. Exported so src/Makefile's own RANDOMX_DIR ?= picks the same tree.
+#
+# Every use of it below is quoted, and the recipe rejects a value that cannot
+# name exactly one directory before it reaches anything destructive. Unquoted,
+# the marker guard could be stepped around: a value holding a glob that matches
+# two directories made `[ -d $(RANDOMX_DIR) ]` a two-argument test, which dies
+# with "unexpected operator" instead of answering, so the && short-circuited,
+# the guard was skipped, and the rm -rf below ran against every match. A value
+# holding a space or a `&&` broke the outer test the same way and reported
+# "already built". Whitespace and glob characters are refused outright rather
+# than merely quoted, because src/Makefile interpolates this same value into
+# -I$(RANDOMX_DIR)/src and -L$(RANDOMX_DIR)/build unquoted, where neither can
+# survive. A relative value is refused rather than silently made absolute: it
+# would mean two different directories to this Makefile and to src/Makefile,
+# whose cwd is src/, and a command-line assignment reaches the sub-make through
+# MAKEFLAGS, where it outranks anything exported from here.
 RANDOMX_DIR ?= $(ROOT)/randomx-build
 export RANDOMX_DIR
 
@@ -126,25 +141,34 @@ deps-secp256k1:
         fi
 
 deps-randomx:
-        @if [ ! -f $(RANDOMX_DIR)/build/librandomx.a ]; then \
-          if [ -d $(RANDOMX_DIR) ] && [ ! -f $(RANDOMX_DIR)/.bitflash-built ]; then \
+        @ws="$$(printf ' \t')"; \
+        case "$(RANDOMX_DIR)" in \
+          "")        echo "ERROR: RANDOMX_DIR is empty"; exit 1 ;; \
+          /)         echo "ERROR: RANDOMX_DIR is /, refusing"; exit 1 ;; \
+          *[$$ws]*)  echo "ERROR: RANDOMX_DIR contains whitespace: $(RANDOMX_DIR)"; exit 1 ;; \
+          *[*?[]*)   echo "ERROR: RANDOMX_DIR contains a glob character: $(RANDOMX_DIR)"; exit 1 ;; \
+          /*)        ;; \
+          *)         echo "ERROR: RANDOMX_DIR must be an absolute path: $(RANDOMX_DIR)"; exit 1 ;; \
+        esac
+        @if [ ! -f "$(RANDOMX_DIR)/build/librandomx.a" ]; then \
+          if [ -d "$(RANDOMX_DIR)" ] && [ ! -f "$(RANDOMX_DIR)/.bitflash-built" ]; then \
             echo "ERROR: $(RANDOMX_DIR) exists but was not created by this build"; \
             echo "       refusing to rm -rf it -- remove it yourself or set RANDOMX_DIR"; \
             exit 1; \
           fi; \
           echo "==> building RandomX"; \
-          rm -rf $(RANDOMX_DIR); \
-          git init -q $(RANDOMX_DIR); \
-          cd $(RANDOMX_DIR) && \
+          rm -rf "$(RANDOMX_DIR)" && \
+          git init -q "$(RANDOMX_DIR)" && \
+          cd "$(RANDOMX_DIR)" && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
           git checkout -q --detach FETCH_HEAD && \
           test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
           echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
-          mkdir -p $(RANDOMX_DIR)/build && \
-          cd $(RANDOMX_DIR)/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+          mkdir -p "$(RANDOMX_DIR)/build" && \
+          cd "$(RANDOMX_DIR)/build" && cmake .. -DCMAKE_BUILD_TYPE=Release && \
           make -j$(NPROC) randomx && \
-          touch $(RANDOMX_DIR)/.bitflash-built && \
+          touch "$(RANDOMX_DIR)/.bitflash-built" && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \