artifact/template: make destination path absolute inside taskdir #9149
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
krishicks
reviewed
Oct 22, 2020
|
Relevant E2E tests against this PR: |
schmichael
approved these changes
Oct 22, 2020
Prior to Nomad 0.12.5, you could use `${NOMAD_SECRETS_DIR}/mysecret.txt` as
the `artifact.destination` and `template.destination` because we would always
append the destination to the task working directory. In the recent security
patch we treated the `destination` absolute path as valid if it didn't escape
the working directory, but this breaks backwards compatibility and
interpolation of `destination` fields.
This changeset partially reverts the behavior so that we always append the
destination, but we also perform the escape check on that new destination
after interpolation so the security hole is closed.
tgross
force-pushed
the
b-template-artifact-destination-abs-path
branch
from
54109b4
to
2bd72e6
Compare
This was referenced Oct 22, 2020
|
I wanted to follow-up and say the updated tests are way more clear to me. Thanks! |
This was referenced Oct 22, 2020
|
I'm going to lock this pull request because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active contributions. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #9148
Prior to Nomad 0.12.5, you could use
${NOMAD_SECRETS_DIR}/mysecret.txtasthe
artifact.destinationandtemplate.destinationbecause we would alwaysappend the destination to the task working directory. In the recent security
patch we treated the
destinationabsolute path as valid if it didn't escapethe working directory, but this breaks backwards compatibility and
interpolation of
destinationfields.This changeset partially reverts the behavior so that we always append the
destination, but we also perform the escape check on that new destination
after interpolation so the security hole is closed.