Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
server(filesystem): rebuild everything imaginable
This wonderfully large commit replaces basically everything under the `server/filesystem` package, re-implementing essentially everything. This is related to GHSA-494h-9924-xww9 If any vulnerabilities related to symlinks persist after this commit, I will be very upset. Signed-off-by: Matthew Penner <me@matthewp.io>
- Loading branch information
Showing
51 changed files
with
3,648 additions
and
1,179 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| MIT License | ||
|
|
||
| Copyright (c) 2024 Matthew Penner | ||
|
|
||
| Permission is hereby granted, free of charge, to any person obtaining a copy | ||
| of this software and associated documentation files (the "Software"), to deal | ||
| in the Software without restriction, including without limitation the rights | ||
| to use, copy, modify, merge, publish, distribute, sublicense, and/or sell | ||
| copies of the Software, and to permit persons to whom the Software is | ||
| furnished to do so, subject to the following conditions: | ||
|
|
||
| The above copyright notice and this permission notice shall be included in all | ||
| copies or substantial portions of the Software. | ||
|
|
||
| THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR | ||
| IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | ||
| FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE | ||
| AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER | ||
| LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, | ||
| OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE | ||
| SOFTWARE. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| # Filesystem | ||
|
|
||
| ## Licensing | ||
|
|
||
| Most code in this package is licensed under `MIT` with some exceptions. | ||
|
|
||
| The following files are licensed under `BSD-3-Clause` due to them being copied | ||
| verbatim or derived from [Go](https://go.dev)'s source code. | ||
|
|
||
| - [`file_posix.go`](./file_posix.go) | ||
| - [`mkdir_unix.go`](./mkdir_unix.go) | ||
| - [`path_unix.go`](./path_unix.go) | ||
| - [`removeall_unix.go`](./removeall_unix.go) | ||
| - [`stat_unix.go`](./stat_unix.go) | ||
| - [`walk.go`](./walk.go) | ||
|
|
||
| These changes are not associated with nor endorsed by The Go Authors. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| // SPDX-License-Identifier: MIT | ||
| // SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner | ||
|
|
||
| // Package ufs provides an abstraction layer for performing I/O on filesystems. | ||
| // This package is designed to be used in-place of standard `os` package I/O | ||
| // calls, and is not designed to be used as a generic filesystem abstraction | ||
| // like the `io/fs` package. | ||
| // | ||
| // The primary use-case of this package was to provide a "chroot-like" `os` | ||
| // wrapper, so we can safely sandbox I/O operations within a directory and | ||
| // use untrusted arbitrary paths. | ||
| package ufs |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,120 @@ | ||
| // SPDX-License-Identifier: MIT | ||
| // SPDX-FileCopyrightText: Copyright (c) 2024 Matthew Penner | ||
|
|
||
| package ufs | ||
|
|
||
| import ( | ||
| "errors" | ||
| iofs "io/fs" | ||
| "os" | ||
|
|
||
| "golang.org/x/sys/unix" | ||
| ) | ||
|
|
||
| var ( | ||
| // ErrIsDirectory is an error for when an operation that operates only on | ||
| // files is given a path to a directory. | ||
| ErrIsDirectory = errors.New("is a directory") | ||
| // ErrNotDirectory is an error for when an operation that operates only on | ||
| // directories is given a path to a file. | ||
| ErrNotDirectory = errors.New("not a directory") | ||
| // ErrBadPathResolution is an error for when a sand-boxed filesystem | ||
| // resolves a given path to a forbidden location. | ||
| ErrBadPathResolution = errors.New("bad path resolution") | ||
| // ErrNotRegular is an error for when an operation that operates only on | ||
| // regular files is passed something other than a regular file. | ||
| ErrNotRegular = errors.New("not a regular file") | ||
|
|
||
| // ErrClosed is an error for when an entry was accessed after being closed. | ||
| ErrClosed = iofs.ErrClosed | ||
| // ErrInvalid is an error for when an invalid argument was used. | ||
| ErrInvalid = iofs.ErrInvalid | ||
| // ErrExist is an error for when an entry already exists. | ||
| ErrExist = iofs.ErrExist | ||
| // ErrNotExist is an error for when an entry does not exist. | ||
| ErrNotExist = iofs.ErrNotExist | ||
| // ErrPermission is an error for when the required permissions to perform an | ||
| // operation are missing. | ||
| ErrPermission = iofs.ErrPermission | ||
| ) | ||
|
|
||
| // LinkError records an error during a link or symlink or rename | ||
| // system call and the paths that caused it. | ||
| type LinkError = os.LinkError | ||
|
|
||
| // PathError records an error and the operation and file path that caused it. | ||
| type PathError = iofs.PathError | ||
|
|
||
| // SyscallError records an error from a specific system call. | ||
| type SyscallError = os.SyscallError | ||
|
|
||
| // NewSyscallError returns, as an error, a new SyscallError | ||
| // with the given system call name and error details. | ||
| // As a convenience, if err is nil, NewSyscallError returns nil. | ||
| func NewSyscallError(syscall string, err error) error { | ||
| return os.NewSyscallError(syscall, err) | ||
| } | ||
|
|
||
| // convertErrorType converts errors into our custom errors to ensure consistent | ||
| // error values. | ||
| func convertErrorType(err error) error { | ||
| if err == nil { | ||
| return nil | ||
| } | ||
| var pErr *PathError | ||
| switch { | ||
| case errors.As(err, &pErr): | ||
| switch { | ||
| // File exists | ||
| case errors.Is(pErr.Err, unix.EEXIST): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrExist, | ||
| } | ||
| // Is a directory | ||
| case errors.Is(pErr.Err, unix.EISDIR): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrIsDirectory, | ||
| } | ||
| // Not a directory | ||
| case errors.Is(pErr.Err, unix.ENOTDIR): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrNotDirectory, | ||
| } | ||
| // No such file or directory | ||
| case errors.Is(pErr.Err, unix.ENOENT): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrNotExist, | ||
| } | ||
| // Operation not permitted | ||
| case errors.Is(pErr.Err, unix.EPERM): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrPermission, | ||
| } | ||
| // Invalid cross-device link | ||
| case errors.Is(pErr.Err, unix.EXDEV): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrBadPathResolution, | ||
| } | ||
| // Too many levels of symbolic links | ||
| case errors.Is(pErr.Err, unix.ELOOP): | ||
| return &PathError{ | ||
| Op: pErr.Op, | ||
| Path: pErr.Path, | ||
| Err: ErrBadPathResolution, | ||
| } | ||
| } | ||
| } | ||
| return err | ||
| } |
Oops, something went wrong.