github/hauler
1
0
Fork 0
mirror of https://github.com/hauler-dev/hauler.git synced 2026-08-27 14:07:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixed bug with store sync extraction into unwritable directory

Browse Source
This commit is contained in:
Zack Brady
2026-08-15 08:21:02 -04:00
parent b75f9a2672
commit 6e4fded924
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/hauler/cli/store/sync.go
+2 -2
View File
@@ -163,12 +163,12 @@ func SyncCmd(ctx context.Context, o *flags.SyncOpts, s *store.Layout, rso *flags
if err != nil {
return fmt.Errorf("failed to fetch product manifest for [%s]: %w", productName, err)
}
err = ExtractCmd(ctx, &flags.ExtractOpts{StoreRootOpts: o.StoreRootOpts}, s, fmt.Sprintf("hauler/%s-manifest.yaml:%s", parts[0], tag))
err = ExtractCmd(ctx, &flags.ExtractOpts{StoreRootOpts: o.StoreRootOpts, DestinationDir: tempDir}, s, fmt.Sprintf("hauler/%s-manifest.yaml:%s", parts[0], tag))
if err != nil {
return err
}
fileName := fmt.Sprintf("%s-manifest.yaml", parts[0])
fi, err := os.Open(fileName)
fi, err := os.Open(filepath.Join(tempDir, fileName))
if err != nil {
return err
}
internal/mapper/filestore.go
+4 -2
View File
@@ -89,8 +89,10 @@ func (s *pusher) Push(ctx context.Context, desc ocispec.Descriptor) (ccontent.Wr
}
fullFileName := filepath.Join(destDir, filename)
// Guard against path traversal (e.g. filename containing "../")
if !strings.HasPrefix(fullFileName, destDir+string(filepath.Separator)) {
// Guard against path traversal (e.g. "../"). filepath.Rel handles this
// correctly even when destDir is "/", unlike a plain prefix check.
rel, err := filepath.Rel(destDir, fullFileName)
if err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
return nil, fmt.Errorf("path_traversal_disallowed: %q resolves outside destination dir", filename)
}