Fix Darion directory traversal vuln

darion/api/handlers.go

@@ -15,6 +15,7 @@ import (
 	"github.com/Netflix/titus-executor/darion/conf"
 	"github.com/Netflix/titus-executor/filesystems"
 	"github.com/Netflix/titus-executor/filesystems/xattr"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -39,7 +40,14 @@ func LogHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 func logHandler(w http.ResponseWriter, r *http.Request, containerID, fileName string) {
-	filePath := filepath.Join(conf.ContainersHome, containerID, "logs", fileName)
+	containerLogsRoot := filepath.Join(conf.ContainersHome, containerID, "logs")
+	filePath, err := securejoin.SecureJoin(containerLogsRoot, fileName)
+	log.Infof("Joined log file %s and %s", containerLogsRoot, filePath)
+	if err != nil {
+		log.WithError(err).Error("Unable to build secure path")
+		http.Error(w, "Cannot build log file path: "+err.Error(), 503)
+		return
+	}
 	fout, err := os.Open(filePath) // nolint: gosec
 	if os.IsNotExist(err) {
 		err = maybeVirtualFileStdioLogHandler(w, r, containerID, fileName)

darion/api/handlers_test.go

@@ -219,6 +219,15 @@ func TestReadLogsMissingContainer(t *testing.T) {
 	testReadLogs(verifyFun, "/logs/Titus-fake-container-missing?f=missing", t)
 }
 
+func TestReadLogsLeakedFile(t *testing.T) {
+	verifyFun := func(resp *http.Response, t *testing.T) {
+		if resp.StatusCode != 404 {
+			t.Fatal("Received non-404 return code: ", resp.StatusCode)
+		}
+	}
+	testReadLogs(verifyFun, "/logs/Titus-fake-container?f=../../leak", t)
+}
+
 func verifyHelper(resp *http.Response, t *testing.T) string {
 	data, err := ioutil.ReadAll(resp.Body)
 	if err != nil {

darion/api/testdata/leak

@@ -0,0 +1 @@
+If this file is viewable, it means there is a directory escape vuln.

vendor/vendor.json

@@ -336,6 +336,12 @@
 			"revision": "099530d80109cc4876ac866c38dded19786731d0",
 			"revisionTime": "2017-04-05T07:26:53Z"
 		},
+		{
+			"checksumSHA1": "Ov+ja3hmONKxbhq9HAgK/vHSi/0=",
+			"path": "github.com/cyphar/filepath-securejoin",
+			"revision": "7efe413b52e1bceaaee7efafebe396f9d648f258",
+			"revisionTime": "2019-02-05T14:40:30Z"
+		},
 		{
 			"checksumSHA1": "CSPbwbyzqA6sfORicn4HFtIhF/c=",
 			"path": "github.com/davecgh/go-spew/spew",