guiwf/lix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #2326 from aszlig/fix-symlink-leak

Browse Source 
Fix symlink leak in restricted eval mode
This commit is contained in:
Eelco Dolstra
2018-08-03 17:01:34 +02:00
committed by GitHub
parent 122e1a61f8 43e28a1b75
commit bc65e02d96
2 changed files with 21 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libexpr/eval.cc
+10 -4
View File
@@ -349,19 +349,25 @@ Path EvalState::checkSourcePath(const Path & path_)
bool found = false;
/* First canonicalize the path without symlinks, so we make sure an
* attacker can't append ../../... to a path that would be in allowedPaths
* and thus leak symlink targets.
*/
Path abspath = canonPath(path_);
for (auto & i : *allowedPaths) {
if (isDirOrInDir(path_, i)) {
if (isDirOrInDir(abspath, i)) {
found = true;
break;
}
}
if (!found)
throw RestrictedPathError("access to path '%1%' is forbidden in restricted mode", path_);
throw RestrictedPathError("access to path '%1%' is forbidden in restricted mode", abspath);
/* Resolve symlinks. */
debug(format("checking access to '%s'") % path_);
Path path = canonPath(path_, true);
debug(format("checking access to '%s'") % abspath);
Path path = canonPath(abspath, true);
for (auto & i : *allowedPaths) {
if (isDirOrInDir(path, i)) {