-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
artifact/template: make destination path absolute inside taskdir #9149
Conversation
Relevant E2E tests against this PR:
|
Prior to Nomad 0.12.5, you could use `${NOMAD_SECRETS_DIR}/mysecret.txt` as the `artifact.destination` and `template.destination` because we would always append the destination to the task working directory. In the recent security patch we treated the `destination` absolute path as valid if it didn't escape the working directory, but this breaks backwards compatibility and interpolation of `destination` fields. This changeset partially reverts the behavior so that we always append the destination, but we also perform the escape check on that new destination after interpolation so the security hole is closed.
54109b4
to
2bd72e6
Compare
I wanted to follow-up and say the updated tests are way more clear to me. Thanks! |
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Fixes #9148
Prior to Nomad 0.12.5, you could use
${NOMAD_SECRETS_DIR}/mysecret.txt
asthe
artifact.destination
andtemplate.destination
because we would alwaysappend the destination to the task working directory. In the recent security
patch we treated the
destination
absolute path as valid if it didn't escapethe working directory, but this breaks backwards compatibility and
interpolation of
destination
fields.This changeset partially reverts the behavior so that we always append the
destination, but we also perform the escape check on that new destination
after interpolation so the security hole is closed.