rustbuild: Normalize paths coming from Python slightly

Fixes #49785

src/bootstrap/config.rs

@@ -325,6 +325,14 @@ struct TomlTarget {
 }
 
 impl Config {
+    fn path_from_python(var_key: &str) -> PathBuf {
+        match env::var_os(var_key) {
+            // Do not trust paths from Python and normalize them slightly (#49785).
+            Some(var_val) => Path::new(&var_val).components().collect(),
+            _ => panic!("expected '{}' to be set", var_key),
+        }
+    }
+
     pub fn default_opts() -> Config {
         let mut config = Config::default();
         config.llvm_enabled = true;
@@ -348,9 +356,9 @@ impl Config {
         config.deny_warnings = true;
 
         // set by bootstrap.py
-        config.src = env::var_os("SRC").map(PathBuf::from).expect("'SRC' to be set");
         config.build = INTERNER.intern_str(&env::var("BUILD").expect("'BUILD' to be set"));
-        config.out = env::var_os("BUILD_DIR").map(PathBuf::from).expect("'BUILD_DIR' set");
+        config.src = Config::path_from_python("SRC");
+        config.out = Config::path_from_python("BUILD_DIR");
 
         let stage0_root = config.out.join(&config.build).join("stage0/bin");
         config.initial_rustc = stage0_root.join(exe("rustc", &config.build));