1 files changed, 32 insertions, 8 deletions

diff --git a/Makefile b/Makefile
index 602c154..c891001 100644
--- a/Makefile
+++ b/Makefile
@@ -67,6 +67,21 @@ APPIMAGETOOL_SHA256 := ed4ce84f0d9caff66f50bcca6ff6f35aae54ce8135408b3fa33abfc3c
 # RANDOMX_DIR=... explicitly; the recipe below will still never delete a
 # directory that lacks the marker file this build writes after a successful
 # build. Exported so src/Makefile's own RANDOMX_DIR ?= picks the same tree.
+#
+# Every use of it below is quoted, and the recipe rejects a value that cannot
+# name exactly one directory before it reaches anything destructive. Unquoted,
+# the marker guard could be stepped around: a value holding a glob that matches
+# two directories made `[ -d $(RANDOMX_DIR) ]` a two-argument test, which dies
+# with "unexpected operator" instead of answering, so the && short-circuited,
+# the guard was skipped, and the rm -rf below ran against every match. A value
+# holding a space or a `&&` broke the outer test the same way and reported
+# "already built". Whitespace and glob characters are refused outright rather
+# than merely quoted, because src/Makefile interpolates this same value into
+# -I$(RANDOMX_DIR)/src and -L$(RANDOMX_DIR)/build unquoted, where neither can
+# survive. A relative value is refused rather than silently made absolute: it
+# would mean two different directories to this Makefile and to src/Makefile,
+# whose cwd is src/, and a command-line assignment reaches the sub-make through
+# MAKEFLAGS, where it outranks anything exported from here.
 RANDOMX_DIR ?= $(ROOT)/randomx-build
 export RANDOMX_DIR
 
@@ -126,25 +141,34 @@ deps-secp256k1:
         fi
 
 deps-randomx:
-        @if [ ! -f $(RANDOMX_DIR)/build/librandomx.a ]; then \
-          if [ -d $(RANDOMX_DIR) ] && [ ! -f $(RANDOMX_DIR)/.bitflash-built ]; then \
+        @ws="$$(printf ' \t')"; \
+        case "$(RANDOMX_DIR)" in \
+          "")        echo "ERROR: RANDOMX_DIR is empty"; exit 1 ;; \
+          /)         echo "ERROR: RANDOMX_DIR is /, refusing"; exit 1 ;; \
+          *[$$ws]*)  echo "ERROR: RANDOMX_DIR contains whitespace: $(RANDOMX_DIR)"; exit 1 ;; \
+          *[*?[]*)   echo "ERROR: RANDOMX_DIR contains a glob character: $(RANDOMX_DIR)"; exit 1 ;; \
+          /*)        ;; \
+          *)         echo "ERROR: RANDOMX_DIR must be an absolute path: $(RANDOMX_DIR)"; exit 1 ;; \
+        esac
+        @if [ ! -f "$(RANDOMX_DIR)/build/librandomx.a" ]; then \
+          if [ -d "$(RANDOMX_DIR)" ] && [ ! -f "$(RANDOMX_DIR)/.bitflash-built" ]; then \
             echo "ERROR: $(RANDOMX_DIR) exists but was not created by this build"; \
             echo "       refusing to rm -rf it -- remove it yourself or set RANDOMX_DIR"; \
             exit 1; \
           fi; \
           echo "==> building RandomX"; \
-          rm -rf $(RANDOMX_DIR); \
-          git init -q $(RANDOMX_DIR); \
-          cd $(RANDOMX_DIR) && \
+          rm -rf "$(RANDOMX_DIR)" && \
+          git init -q "$(RANDOMX_DIR)" && \
+          cd "$(RANDOMX_DIR)" && \
           git remote add origin $(RANDOMX_REPO) && \
           git fetch -q --depth 1 origin $(RANDOMX_COMMIT) && \
           git checkout -q --detach FETCH_HEAD && \
           test "$$(git rev-parse HEAD)" = "$(RANDOMX_COMMIT)" && \
           echo "==> RandomX pinned at $(RANDOMX_COMMIT)" && \
-          mkdir -p $(RANDOMX_DIR)/build && \
-          cd $(RANDOMX_DIR)/build && cmake .. -DCMAKE_BUILD_TYPE=Release && \
+          mkdir -p "$(RANDOMX_DIR)/build" && \
+          cd "$(RANDOMX_DIR)/build" && cmake .. -DCMAKE_BUILD_TYPE=Release && \
           make -j$(NPROC) randomx && \
-          touch $(RANDOMX_DIR)/.bitflash-built && \
+          touch "$(RANDOMX_DIR)/.bitflash-built" && \
           echo "==> RandomX done"; \
         else \
           echo "==> RandomX already built"; \