vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Fixed relative filepath check

Browse source 
Signed-off-by: Jason Sommer <jsdirv@gmail.com>
This commit is contained in:
Jason Sommer 2015-02-16 20:38:52 -06:00
parent 35464d7db3
commit eba8586d2b
3 changed files with 28 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
archive/archive.go
View file

@ -525,7 +525,7 @@ loop:
if err != nil {
return err
}
if strings.HasPrefix(rel, "..") {
if strings.HasPrefix(rel, "../") {
return breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
}

2
archive/diff.go
View file

@ -81,7 +81,7 @@ func UnpackLayer(dest string, layer ArchiveReader) (size int64, err error) {
if err != nil {
return 0, err
}
if strings.HasPrefix(rel, "..") {
if strings.HasPrefix(rel, "../") {
return 0, breakoutError(fmt.Errorf("%q is outside of %q", hdr.Name, dest))
}
base := filepath.Base(path)

26
chrootarchive/archive_test.go
View file

@ -99,3 +99,29 @@ func TestChrootApplyEmptyArchiveFromSlowReader(t *testing.T) {
t.Fatal(err)
}
}
func TestChrootApplyDotDotFile(t *testing.T) {
tmpdir, err := ioutil.TempDir("", "docker-TestChrootApplyDotDotFile")
if err != nil {
t.Fatal(err)
}
defer os.RemoveAll(tmpdir)
src := filepath.Join(tmpdir, "src")
if err := os.MkdirAll(src, 0700); err != nil {
t.Fatal(err)
}
if err := ioutil.WriteFile(filepath.Join(src, "..gitme"), []byte(""), 0644); err != nil {
t.Fatal(err)
}
stream, err := archive.Tar(src, archive.Uncompressed)
if err != nil {
t.Fatal(err)
}
dest := filepath.Join(tmpdir, "dest")
if err := os.MkdirAll(dest, 0700); err != nil {
t.Fatal(err)
}
if _, err := ApplyLayer(dest, stream); err != nil {
t.Fatal(err)
}
}