Fix false positives in bundle root check (open-policy-agent#3033)

Allow writing to /data/foo when /data/foobar is a bundle root.

Fixes open-policy-agent#2868

Signed-off-by: Anders Eknert <anders@eknert.com>
Signed-off-by: Ansu Varghese <avarghese@us.ibm.com>

server/server.go

@@ -1994,9 +1994,15 @@ func (s *Server) checkPathScope(ctx context.Context, txn storage.Transaction, pa
 
 	spath := strings.Trim(path.String(), "/")
 
+	if spath == "" && len(bundleRoots) > 0 {
+		return types.BadRequestErr("can't write to document root with bundle roots configured")
+	}
+
+	spathParts := strings.Split(spath, "/")
+
 	for name, roots := range bundleRoots {
 		for _, root := range roots {
-			if strings.HasPrefix(spath, root) || strings.HasPrefix(root, spath) {
+			if isPathOwned(spathParts, strings.Split(root, "/")) {
 				return types.BadRequestErr(fmt.Sprintf("path %v is owned by bundle %q", spath, name))
 			}
 		}
@@ -2209,6 +2215,15 @@ func (s *Server) generateDefaultDecisionPath() string {
 	return p
 }
 
+func isPathOwned(path, root []string) bool {
+	for i := 0; i < len(path) && i < len(root); i++ {
+		if path[i] != root[i] {
+			return false
+		}
+	}
+	return true
+}
+
 // parsePatchPathEscaped returns a new path for the given escaped str.
 // This is based on storage.ParsePathEscaped so will do URL unescaping of
 // the provided str for backwards compatibility, but also handles the

server/server_test.go

@@ -1330,7 +1330,7 @@ func TestBundleScope(t *testing.T) {
 
 	if err := bundle.WriteManifestToStore(ctx, f.server.store, txn, "test-bundle", bundle.Manifest{
 		Revision: "AAAAA",
-		Roots:    &[]string{"a/b/c", "x/y"},
+		Roots:    &[]string{"a/b/c", "x/y", "foobar"},
 	}); err != nil {
 		t.Fatal(err)
 	}
@@ -1365,6 +1365,12 @@ func TestBundleScope(t *testing.T) {
 			code:   http.StatusBadRequest,
 			resp:   `{"code": "invalid_parameter", "message": "path a/b/c/d is owned by bundle \"test-bundle\""}`,
 		},
+		{
+			method: "PUT",
+			path:   "/data/a/b/d",
+			body:   "1",
+			code:   http.StatusNoContent,
+		},
 		{
 			method: "PATCH",
 			path:   "/data/a",
@@ -1397,6 +1403,19 @@ func TestBundleScope(t *testing.T) {
 			body:   "1",
 			code:   http.StatusNoContent,
 		},
+		{
+			method: "PUT",
+			path:   "/data/foo",
+			body:   "1",
+			code:   http.StatusNoContent,
+		},
+		{
+			method: "PUT",
+			path:   "/data",
+			body:   `{"a": "b"}`,
+			code:   http.StatusBadRequest,
+			resp:   `{"code": "invalid_parameter", "message": "can't write to document root with bundle roots configured"}`,
+		},
 	}
 
 	if err := f.v1TestRequests(cases); err != nil {