blobs: check external-io-dir containment on path boundaries#172712
Open
fr-manvi wants to merge 1 commit into
Open
blobs: check external-io-dir containment on path boundaries#172712fr-manvi wants to merge 1 commit into
fr-manvi wants to merge 1 commit into
Conversation
ensureContained compared the joined path against the absolute external I/O directory with a string prefix test. filepath.Join has already resolved the .. segments at that point, so a path landing on a sibling directory whose name begins with the I/O directory's name satisfied the prefix and was accepted: with --external-io-dir=/data/backups, nodelocal://1/../backups-archive/x resolved to /data/backups-archive/x. Every LocalStorage operation routes through this helper, so reads, writes, deletes, stats and listings all left the directory that way. Compare with filepath.Rel instead, which restores the boundary and stays lexical so symlinked I/O directories keep working. Epic: none Release note (bug fix): Fixed a bug where a nodelocal path could resolve to a directory outside the one configured with --external-io-dir, if that directory's name started with the configured directory's name.
|
Thank you for contributing to CockroachDB. Please ensure you have followed the guidelines for creating a PR. My owl senses detect your PR is good for review. Please keep an eye out for any test failures in CI. I was unable to automatically find a reviewer. You can try CCing one of the following members:
🦉 Hoot! I am a Blathers, a bot for CockroachDB. My owner is dev-inf. |
blathers-crl
Bot
added
O-community
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The blob service resolves every nodelocal path against the configured
--external-io-dirand then checks that the result stayed inside it, butensureContaineddoes that with a plain string prefix test against the absolute directory.filepath.Joinhas already collapsed the..segments by the time the check runs, so a path that lands on a sibling directory whose name merely begins with the I/O directory's name satisfies the prefix and is accepted: with--external-io-dir=/data/backups,nodelocal://1/../backups-archive/xresolves to/data/backups-archive/xand passes. EveryLocalStorageentry point routes through the same helper, so reads, writes, deletes, stats and listings all leave the directory the same way, whether they arrive from anodelocal://URI or over the Blob gRPC service. I noticed it while working out what the I/O directory actually guarantees for a principal that has been given external IO access but is not otherwise trusted with the node's filesystem. Comparing withfilepath.Relrestores the boundary while keeping the check purely lexical, which is what the comment aboveprependExternalIODirasks for so that operators can still open up the directory with symlinks. The test covers the sibling-prefix case alongside the ordinary parent traversal that was already rejected.Epic: none