Conversation
If a user provides an unclean root path, we will implicitly clean it at the end of SecureJoin (which may result in a path that doesn't exist or has "escaped" the root). Such usage is fundamentally unsafe so we should just return an error. Reported-by: Erik Sjölund <erik.sjolund@gmail.com> Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
|
This breaks the following use case: https://github.com/opencontainers/runc/blob/610aa88ab201f289c05c2e262912d0630f46eb35/tests/cmd/seccompagent/seccompagent.go#L143-L154 I was thinking about more relaxed checking rules (such as, merely checking that |
Or maybe it's easy. A naive approach is to do something like this: if strings.Contains("/"+root+"/", "/../") {
return "", errUncleanRoot
}This should allow for harmless stuff like ending slash, extra slashes, or |
|
The problem is Windows paths, though I think I can come up with a solution for that... (In theory we just need to strip the volume first but Windows has some wacky features like |
If a user provides an unclean root path, we will implicitly clean it at
the end of SecureJoin (which may result in a path that doesn't exist or
has "escaped" the root). Such usage is fundamentally unsafe so we should
just return an error.
Fixes #42
Reported-by: Erik Sjölund erik.sjolund@gmail.com
Signed-off-by: Aleksa Sarai cyphar@cyphar.com