fix(deps): update module github.com/cyphar/filepath-securejoin to v0.4.1 - autoclosed#25001
fix(deps): update module github.com/cyphar/filepath-securejoin to v0.4.1 - autoclosed#25001renovate[bot] wants to merge 1 commit intomainfrom
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: renovate[bot] The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Ephemeral COPR build failed. @containers/packit-build please check. |
14d50b7 to
a254be2
Compare
|
This needs opencontainers/runc#4590 . |
|
Just so that it is not lost, Podman tests also need updating: commit 4449a5ad759dc3a917b5fed75334cc3342ed68f2
Author: Miloslav Trmač <mitr@redhat.com>
Date: Tue Jan 14 22:54:19 2025 +0100
WIP: Update for filepath-securejoin 0.4.0
The root of filepath.* now must exist.
Signed-off-by: Miloslav Trmač <mitr@redhat.com>
diff --git a/libpod/container_internal_linux_test.go b/libpod/container_internal_linux_test.go
index 4deb513b8..586c5fc19 100644
--- a/libpod/container_internal_linux_test.go
+++ b/libpod/container_internal_linux_test.go
@@ -18,7 +18,7 @@ func TestGenerateUserPasswdEntry(t *testing.T) {
},
},
state: &ContainerState{
- Mountpoint: "/does/not/exist/tmp/",
+ Mountpoint: t.TempDir(),
},
}
user, err := c.generateUserPasswdEntry(0)
@@ -44,7 +44,7 @@ func TestGenerateUserGroupEntry(t *testing.T) {
},
},
state: &ContainerState{
- Mountpoint: "/does/not/exist/tmp/",
+ Mountpoint: t.TempDir(),
},
}
group, err := c.generateUserGroupEntry(0) |
|
Most probably a newer version (0.4.1?) will be released, relaxing the SecureJoin's root requirement (see cyphar/filepath-securejoin#47). Therefore, we can just skip 0.4.0. |
|
https://github.com/cyphar/filepath-securejoin/releases/tag/v0.4.1 Sorry about that. |
|
Can someone please tick the 'rebase' checkbox in the description (to bump to 0.4.1)? |
a254be2 to
0213d06
Compare
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
0213d06 to
553da36
Compare
|
opencontainers/runc#4590 was merged, but only on the main branch; Go calls that version Options:
|
This is the most likely thing to happen. We have a few fixes that might merit a backport, I'll try to submit something soon.
|
This PR contains the following updates:
v0.3.6->v0.4.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
cyphar/filepath-securejoin (github.com/cyphar/filepath-securejoin)
v0.4.1Compare Source
This release fixes a regression introduced in one of the hardening
features added to filepath-securejoin 0.4.0.
rootpaths passed toSecureJoinin 0.4.0 wasfound to be too strict and caused some regressions when folks tried to
update, so this restriction has been relaxed to only return an error if the
path contains a
..component. We still recommend users usefilepath.Clean(and even
filepath.EvalSymlinks) on therootpath they are using, but atleast you will no longer be punished for "trivial" unclean paths. (#46)
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
v0.4.0Compare Source
This release primarily includes a few minor breaking changes to make the
MkdirAll and SecureJoin interfaces more robust against accidental
misuse.
SecureJoin(VFS)will now return an error if the providedrootis not afilepath.Clean'd path.While it is ultimately the responsibility of the caller to ensure the root is
a safe path to use, passing a path like
/symlink/..as a root would resultin the
SecureJoin'd path being placed in/even though/symlink/..might be a different directory, and so we should more strongly discourage
such usage.
All major users of
securejoin.SecureJoinalready ensure that the paths theyprovide are safe (and this is ultimately a question of user error), but
removing this foot-gun is probably a good idea. Of course, this is
necessarily a breaking API change (though we expect no real users to be
affected by it).
Thanks to Erik Sjölund, who initially
reported this issue as a possible security issue.
MkdirAllandMkdirHandlenow take anos.FileMode-style mode argumentinstead of a raw
unix.S_*-style mode argument, which may cause compile-timetype errors depending on how you use
filepath-securejoin. For most users,there will be no change in behaviour aside from the type change (as the
bottom
0o777bits are the same in both formats, and most users are probablyonly using those bits).
However, if you were using
unix.S_ISVTXto set the sticky bit withMkdirAll(Handle)you will need to switch toos.ModeStickyotherwise youwill get a runtime error with this update. In addition, the error message you
will get from passing
unix.S_ISUIDandunix.S_ISGIDwill be different asthey are treated as invalid bits now (note that previously passing said bits
was also an error).
Thanks to the following contributors for helping make this release
possible:
Signed-off-by: Aleksa Sarai cyphar@cyphar.com
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Never, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.