1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
|
package safepath
import (
"context"
"os"
"path/filepath"
"strings"
"github.com/containerd/log"
"github.com/docker/docker/internal/cleanups"
"github.com/docker/docker/internal/compatcontext"
"github.com/pkg/errors"
"golang.org/x/sys/windows"
)
// Join locks all individual components of the path which is the concatenation
// of provided path and its subpath, checks that it doesn't escape the base path
// and returns the concatenated path.
//
// The path is safe (the path target won't change) until the returned SafePath
// is Closed.
// Caller is responsible for calling the Close function which unlocks the path.
func Join(ctx context.Context, path, subpath string) (*SafePath, error) {
base, subpart, err := evaluatePath(path, subpath)
if err != nil {
return nil, err
}
parts := strings.Split(subpart, string(os.PathSeparator))
cleanups := cleanups.Composite{}
defer func() {
if cErr := cleanups.Call(compatcontext.WithoutCancel(ctx)); cErr != nil {
log.G(ctx).WithError(cErr).Warn("failed to close handles after error")
}
}()
fullPath := base
for _, part := range parts {
fullPath = filepath.Join(fullPath, part)
handle, err := lockFile(fullPath)
if err != nil {
if errors.Is(err, windows.ERROR_FILE_NOT_FOUND) {
return nil, &ErrNotAccessible{Path: fullPath, Cause: err}
}
return nil, errors.Wrapf(err, "failed to lock file %s", fullPath)
}
cleanups.Add(func(context.Context) error {
if err := windows.CloseHandle(handle); err != nil {
return &os.PathError{Op: "CloseHandle", Path: fullPath, Err: err}
}
return err
})
realPath, err := filepath.EvalSymlinks(fullPath)
if err != nil {
return nil, errors.Wrapf(err, "failed to eval symlinks of %s", fullPath)
}
if realPath != fullPath && !isLocalTo(realPath, base) {
return nil, &ErrEscapesBase{Base: base, Subpath: subpart}
}
var info windows.ByHandleFileInformation
if err := windows.GetFileInformationByHandle(handle, &info); err != nil {
return nil, errors.WithStack(&os.PathError{Op: "GetFileInformationByHandle", Path: fullPath, Err: err})
}
if (info.FileAttributes & windows.FILE_ATTRIBUTE_REPARSE_POINT) != 0 {
return nil, &ErrNotAccessible{Path: fullPath, Cause: err}
}
}
return &SafePath{
path: fullPath,
sourceBase: base,
sourceSubpath: subpart,
cleanup: cleanups.Release(),
}, nil
}
func lockFile(path string) (windows.Handle, error) {
p, err := windows.UTF16PtrFromString(path)
if err != nil {
return windows.InvalidHandle, &os.PathError{Op: "UTF16PtrFromString", Path: path, Err: err}
}
const flags = windows.FILE_FLAG_BACKUP_SEMANTICS | windows.FILE_FLAG_OPEN_REPARSE_POINT
handle, err := windows.CreateFile(p, windows.GENERIC_READ, windows.FILE_SHARE_READ, nil, windows.OPEN_EXISTING, flags, 0)
if err != nil {
return handle, &os.PathError{Op: "CreateFile", Path: path, Err: err}
}
return handle, nil
}
|
