From 3ad12e749cfe7dc674e0f7092b897ce896dcb9a5 Mon Sep 17 00:00:00 2001
From: Anders Eknert <anders@eknert.com>
Date: Tue, 5 Jan 2021 11:46:41 +0100
Subject: [PATCH] Fix false positives in bundle root check (#3033)

Allow writing to /data/foo when /data/foobar is a bundle root.

Fixes #2868

Signed-off-by: Anders Eknert <anders@eknert.com>
Signed-off-by: Ansu Varghese <avarghese@us.ibm.com>
---
 server/server.go      | 17 ++++++++++++++++-
 server/server_test.go | 21 ++++++++++++++++++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/server/server.go b/server/server.go
index f60673f9fc..d994d36531 100644
--- a/server/server.go
+++ b/server/server.go
@@ -1994,9 +1994,15 @@ func (s *Server) checkPathScope(ctx context.Context, txn storage.Transaction, pa
 
 	spath := strings.Trim(path.String(), "/")
 
+	if spath == "" && len(bundleRoots) > 0 {
+		return types.BadRequestErr("can't write to document root with bundle roots configured")
+	}
+
+	spathParts := strings.Split(spath, "/")
+
 	for name, roots := range bundleRoots {
 		for _, root := range roots {
-			if strings.HasPrefix(spath, root) || strings.HasPrefix(root, spath) {
+			if isPathOwned(spathParts, strings.Split(root, "/")) {
 				return types.BadRequestErr(fmt.Sprintf("path %v is owned by bundle %q", spath, name))
 			}
 		}
@@ -2209,6 +2215,15 @@ func (s *Server) generateDefaultDecisionPath() string {
 	return p
 }
 
+func isPathOwned(path, root []string) bool {
+	for i := 0; i < len(path) && i < len(root); i++ {
+		if path[i] != root[i] {
+			return false
+		}
+	}
+	return true
+}
+
 // parsePatchPathEscaped returns a new path for the given escaped str.
 // This is based on storage.ParsePathEscaped so will do URL unescaping of
 // the provided str for backwards compatibility, but also handles the
diff --git a/server/server_test.go b/server/server_test.go
index 2c7e548a7b..32e7e78d8a 100644
--- a/server/server_test.go
+++ b/server/server_test.go
@@ -1330,7 +1330,7 @@ func TestBundleScope(t *testing.T) {
 
 	if err := bundle.WriteManifestToStore(ctx, f.server.store, txn, "test-bundle", bundle.Manifest{
 		Revision: "AAAAA",
-		Roots:    &[]string{"a/b/c", "x/y"},
+		Roots:    &[]string{"a/b/c", "x/y", "foobar"},
 	}); err != nil {
 		t.Fatal(err)
 	}
@@ -1365,6 +1365,12 @@ func TestBundleScope(t *testing.T) {
 			code:   http.StatusBadRequest,
 			resp:   `{"code": "invalid_parameter", "message": "path a/b/c/d is owned by bundle \"test-bundle\""}`,
 		},
+		{
+			method: "PUT",
+			path:   "/data/a/b/d",
+			body:   "1",
+			code:   http.StatusNoContent,
+		},
 		{
 			method: "PATCH",
 			path:   "/data/a",
@@ -1397,6 +1403,19 @@ func TestBundleScope(t *testing.T) {
 			body:   "1",
 			code:   http.StatusNoContent,
 		},
+		{
+			method: "PUT",
+			path:   "/data/foo",
+			body:   "1",
+			code:   http.StatusNoContent,
+		},
+		{
+			method: "PUT",
+			path:   "/data",
+			body:   `{"a": "b"}`,
+			code:   http.StatusBadRequest,
+			resp:   `{"code": "invalid_parameter", "message": "can't write to document root with bundle roots configured"}`,
+		},
 	}
 
 	if err := f.v1TestRequests(cases); err != nil {