Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
Do not permit access to Windows reserved device names (NUL, COM1, etc.) via os.DirFS and http.Dir filesystems. Avoid escapes from os.DirFS(`\`) on Windows. DirFS would join the the root to the relative path with a path separator, making os.DirFS(`\`).Open(`/foo/bar`) open the path `\\foo\bar`, which is a UNC name. Not only does this not open the intended file, but permits reference to any file on the system rather than only files on the current drive. Make os.DirFS("") invalid, with all file access failing. Previously, a root of "" was interpreted as "/", which is surprising and probably unintentional. Fixes CVE-2022-41720 Fixes #56694 Change-Id: I275b5fa391e6ad7404309ea98ccc97405942e0f0 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1663834 Reviewed-by: Tatiana Bradley <tatianabradley@google.com> Reviewed-by: Julie Qiu <julieqiu@google.com> Reviewed-on: https://go-review.googlesource.com/c/go/+/455362 Reviewed-by: Michael Pratt <mpratt@google.com> TryBot-Result: Gopher Robot <gobot@golang.org> Run-TryBot: Jenny Rakoczy <jenny@golang.org> Reviewed-on: https://go-review.googlesource.com/c/go/+/455716 Reviewed-by: Jenny Rakoczy <jenny@golang.org> Run-TryBot: Damien Neil <dneil@google.com>
- Loading branch information
Showing
9 changed files
with
316 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,21 @@ | ||
// Copyright 2022 The Go Authors. All rights reserved. | ||
// Use of this source code is governed by a BSD-style | ||
// license that can be found in the LICENSE file. | ||
|
||
// Package safefilepath manipulates operating-system file paths. | ||
package safefilepath | ||
|
||
import ( | ||
"errors" | ||
) | ||
|
||
var errInvalidPath = errors.New("invalid path") | ||
|
||
// FromFS converts a slash-separated path into an operating-system path. | ||
// | ||
// FromFS returns an error if the path cannot be represented by the operating | ||
// system. For example, paths containing '\' and ':' characters are rejected | ||
// on Windows. | ||
func FromFS(path string) (string, error) { | ||
return fromFS(path) | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,23 @@ | ||
// Copyright 2022 The Go Authors. All rights reserved. | ||
// Use of this source code is governed by a BSD-style | ||
// license that can be found in the LICENSE file. | ||
|
||
//go:build !windows | ||
|
||
package safefilepath | ||
|
||
import "runtime" | ||
|
||
func fromFS(path string) (string, error) { | ||
if runtime.GOOS == "plan9" { | ||
if len(path) > 0 && path[0] == '#' { | ||
return path, errInvalidPath | ||
} | ||
} | ||
for i := range path { | ||
if path[i] == 0 { | ||
return "", errInvalidPath | ||
} | ||
} | ||
return path, nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,88 @@ | ||
// Copyright 2022 The Go Authors. All rights reserved. | ||
// Use of this source code is governed by a BSD-style | ||
// license that can be found in the LICENSE file. | ||
|
||
package safefilepath_test | ||
|
||
import ( | ||
"internal/safefilepath" | ||
"os" | ||
"path/filepath" | ||
"runtime" | ||
"testing" | ||
) | ||
|
||
type PathTest struct { | ||
path, result string | ||
} | ||
|
||
const invalid = "" | ||
|
||
var fspathtests = []PathTest{ | ||
{".", "."}, | ||
{"/a/b/c", "/a/b/c"}, | ||
{"a\x00b", invalid}, | ||
} | ||
|
||
var winreservedpathtests = []PathTest{ | ||
{`a\b`, `a\b`}, | ||
{`a:b`, `a:b`}, | ||
{`a/b:c`, `a/b:c`}, | ||
{`NUL`, `NUL`}, | ||
{`./com1`, `./com1`}, | ||
{`a/nul/b`, `a/nul/b`}, | ||
} | ||
|
||
// Whether a reserved name with an extension is reserved or not varies by | ||
// Windows version. | ||
var winreservedextpathtests = []PathTest{ | ||
{"nul.txt", "nul.txt"}, | ||
{"a/nul.txt/b", "a/nul.txt/b"}, | ||
} | ||
|
||
var plan9reservedpathtests = []PathTest{ | ||
{`#c`, `#c`}, | ||
} | ||
|
||
func TestFromFS(t *testing.T) { | ||
switch runtime.GOOS { | ||
case "windows": | ||
if canWriteFile(t, "NUL") { | ||
t.Errorf("can unexpectedly write a file named NUL on Windows") | ||
} | ||
if canWriteFile(t, "nul.txt") { | ||
fspathtests = append(fspathtests, winreservedextpathtests...) | ||
} else { | ||
winreservedpathtests = append(winreservedpathtests, winreservedextpathtests...) | ||
} | ||
for i := range winreservedpathtests { | ||
winreservedpathtests[i].result = invalid | ||
} | ||
for i := range fspathtests { | ||
fspathtests[i].result = filepath.FromSlash(fspathtests[i].result) | ||
} | ||
case "plan9": | ||
for i := range plan9reservedpathtests { | ||
plan9reservedpathtests[i].result = invalid | ||
} | ||
} | ||
tests := fspathtests | ||
tests = append(tests, winreservedpathtests...) | ||
tests = append(tests, plan9reservedpathtests...) | ||
for _, test := range tests { | ||
got, err := safefilepath.FromFS(test.path) | ||
if (got == "") != (err != nil) { | ||
t.Errorf(`FromFS(%q) = %q, %v; want "" only if err != nil`, test.path, got, err) | ||
} | ||
if got != test.result { | ||
t.Errorf("FromFS(%q) = %q, %v; want %q", test.path, got, err, test.result) | ||
} | ||
} | ||
} | ||
|
||
func canWriteFile(t *testing.T, name string) bool { | ||
path := filepath.Join(t.TempDir(), name) | ||
os.WriteFile(path, []byte("ok"), 0666) | ||
b, _ := os.ReadFile(path) | ||
return string(b) == "ok" | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,95 @@ | ||
// Copyright 2022 The Go Authors. All rights reserved. | ||
// Use of this source code is governed by a BSD-style | ||
// license that can be found in the LICENSE file. | ||
|
||
package safefilepath | ||
|
||
import ( | ||
"syscall" | ||
"unicode/utf8" | ||
) | ||
|
||
func fromFS(path string) (string, error) { | ||
if !utf8.ValidString(path) { | ||
return "", errInvalidPath | ||
} | ||
for len(path) > 1 && path[0] == '/' && path[1] == '/' { | ||
path = path[1:] | ||
} | ||
containsSlash := false | ||
for p := path; p != ""; { | ||
// Find the next path element. | ||
i := 0 | ||
dot := -1 | ||
for i < len(p) && p[i] != '/' { | ||
switch p[i] { | ||
case 0, '\\', ':': | ||
return "", errInvalidPath | ||
case '.': | ||
if dot < 0 { | ||
dot = i | ||
} | ||
} | ||
i++ | ||
} | ||
part := p[:i] | ||
if i < len(p) { | ||
containsSlash = true | ||
p = p[i+1:] | ||
} else { | ||
p = "" | ||
} | ||
// Trim the extension and look for a reserved name. | ||
base := part | ||
if dot >= 0 { | ||
base = part[:dot] | ||
} | ||
if isReservedName(base) { | ||
if dot < 0 { | ||
return "", errInvalidPath | ||
} | ||
// The path element is a reserved name with an extension. | ||
// Some Windows versions consider this a reserved name, | ||
// while others do not. Use FullPath to see if the name is | ||
// reserved. | ||
if p, _ := syscall.FullPath(part); len(p) >= 4 && p[:4] == `\\.\` { | ||
return "", errInvalidPath | ||
} | ||
} | ||
} | ||
if containsSlash { | ||
// We can't depend on strings, so substitute \ for / manually. | ||
buf := []byte(path) | ||
for i, b := range buf { | ||
if b == '/' { | ||
buf[i] = '\\' | ||
} | ||
} | ||
path = string(buf) | ||
} | ||
return path, nil | ||
} | ||
|
||
// isReservedName reports if name is a Windows reserved device name. | ||
// It does not detect names with an extension, which are also reserved on some Windows versions. | ||
// | ||
// For details, search for PRN in | ||
// https://docs.microsoft.com/en-us/windows/desktop/fileio/naming-a-file. | ||
func isReservedName(name string) bool { | ||
if 3 <= len(name) && len(name) <= 4 { | ||
switch string([]byte{toUpper(name[0]), toUpper(name[1]), toUpper(name[2])}) { | ||
case "CON", "PRN", "AUX", "NUL": | ||
return len(name) == 3 | ||
case "COM", "LPT": | ||
return len(name) == 4 && '1' <= name[3] && name[3] <= '9' | ||
} | ||
} | ||
return false | ||
} | ||
|
||
func toUpper(c byte) byte { | ||
if 'a' <= c && c <= 'z' { | ||
return c - ('a' - 'A') | ||
} | ||
return c | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.