join: loosen cleanliness requirements for SecureJoin root #47
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@kolyshkin WDYT? |
kolyshkin
reviewed
Jan 22, 2025
kolyshkin
reviewed
Jan 22, 2025
kolyshkin
approved these changes
Jan 22, 2025
a8c834f to
85ed0ef
Compare
85ed0ef to
fe5f60f
Compare
It turns out that some users do provide unclean paths like "foo/bar/" and as a result the new behaviour in commit bc750ad ("join: return an error if root is unclean path") was far too aggressive and lead to regressions. The more gentle solution is to only error out if the path contains a ".." component (which is the only component type we are really worried about here because it's the only one that can turn a safe root-joined-path into an unsafe one due to how symlinks are resolved on Linux). Fixes: bc750ad ("join: return an error if root is unclean path") Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
fe5f60f to
fbaef26
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
It turns out that some users do provide unclean paths like "foo/bar/"
and as a result the new behaviour in commit bc750ad ("join: return
an error if root is unclean path") was far too aggressive and lead to
regressions.
The more gentle solution is to only error out if the path contains a
".." component (which is the only component type we are really worried
about here because it's the only one that can turn a safe
root-joined-path into an unsafe one due to how symlinks are resolved on
Linux).
Fixes: bc750ad ("join: return an error if root is unclean path")
Fixes #46
Signed-off-by: Aleksa Sarai cyphar@cyphar.com