mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-08-19 05:36:58 +00:00
Chris LuandGitHub
0345658ea8
* s3: validate indirect filer path inputs * s3: avoid query parsing on common request path * filer: scope copy/move source against JWT AllowedPrefixes maybeCheckJwtAuthorization only checked r.URL.Path, but copy and move read their source from the cp.from / mv.from query params. A prefix-restricted token could copy or move data out of a subtree it cannot otherwise reach. Check every path the request touches, reusing pathHasComponentPrefix so `..` in the source is collapsed before the prefix match. * s3: confine iceberg CreateTable location to the catalog bucket CreateTable derived the metadata bucket and path from the client-supplied req.Location / req.Name and wrote there directly, so a caller scoped to one table bucket could place metadata in another bucket (and path.Join collapsed any `..`). Require the parsed bucket to equal the request's catalog bucket and reject traversal segments in the table path. * webdav: clean client path before subFolder confinement wrappedFs concatenated subFolder + name before the underlying FileSystem ran path.Clean, so `..` in the request path or COPY/MOVE Destination resolved across the FilerRootPath confinement boundary. Clean the name as a rooted path first so traversal segments collapse below subFolder. Only the non-default -filer.path (non-empty subFolder) setup was affected. * filer: enforce read-only rule on real write path with destination header The x-seaweedfs-destination header overrides the path used for storage-rule matching while the entry is written at r.URL.Path, letting a caller select a writable rule for a read-only target. When the header is present, also check the read-only/quota rule against the actual write path.
116 lines
2.8 KiB
Go
116 lines
2.8 KiB
Go
package weed_server
|
|
|
|
import (
|
|
"context"
|
|
"io/fs"
|
|
"os"
|
|
"path"
|
|
"strings"
|
|
|
|
"golang.org/x/net/webdav"
|
|
)
|
|
|
|
type wrappedFs struct {
|
|
subFolder string
|
|
webdav.FileSystem
|
|
}
|
|
|
|
// confine joins a client-supplied name under subFolder. The name is cleaned as
|
|
// a rooted path first so `..` segments cannot climb above subFolder; cleaning
|
|
// after the concat (as the underlying FileSystem does) would resolve them across
|
|
// the confinement boundary.
|
|
func (w wrappedFs) confine(name string) string {
|
|
return w.subFolder + path.Clean("/"+name)
|
|
}
|
|
|
|
// NewWrappedFs returns a webdav.FileSystem identical to fs, except it
|
|
// provides access to a sub-folder of fs that is denominated by subFolder.
|
|
// It transparently handles renaming paths and filenames so that the outer part of the wrapped filesystem
|
|
// does not leak out.
|
|
func NewWrappedFs(fs webdav.FileSystem, subFolder string) webdav.FileSystem {
|
|
return wrappedFs{
|
|
subFolder: subFolder,
|
|
FileSystem: fs,
|
|
}
|
|
}
|
|
|
|
func (w wrappedFs) Mkdir(ctx context.Context, name string, perm os.FileMode) error {
|
|
name = w.confine(name)
|
|
return w.FileSystem.Mkdir(ctx, name, perm)
|
|
}
|
|
|
|
func (w wrappedFs) OpenFile(ctx context.Context, name string, flag int, perm os.FileMode) (webdav.File, error) {
|
|
name = w.confine(name)
|
|
file, err := w.FileSystem.OpenFile(ctx, name, flag, perm)
|
|
file = wrappedFile{
|
|
File: file,
|
|
subFolder: &w.subFolder,
|
|
}
|
|
|
|
return file, err
|
|
}
|
|
|
|
func (w wrappedFs) RemoveAll(ctx context.Context, name string) error {
|
|
name = w.confine(name)
|
|
return w.FileSystem.RemoveAll(ctx, name)
|
|
}
|
|
|
|
func (w wrappedFs) Rename(ctx context.Context, oldName, newName string) error {
|
|
oldName = w.confine(oldName)
|
|
newName = w.confine(newName)
|
|
return w.FileSystem.Rename(ctx, oldName, newName)
|
|
}
|
|
|
|
func (w wrappedFs) Stat(ctx context.Context, name string) (os.FileInfo, error) {
|
|
name = w.confine(name)
|
|
info, err := w.FileSystem.Stat(ctx, name)
|
|
info = wrappedFileInfo{
|
|
subFolder: &w.subFolder,
|
|
FileInfo: info,
|
|
}
|
|
return info, err
|
|
}
|
|
|
|
type wrappedFile struct {
|
|
webdav.File
|
|
subFolder *string
|
|
}
|
|
|
|
func (w wrappedFile) Readdir(count int) ([]fs.FileInfo, error) {
|
|
infos, err := w.File.Readdir(count)
|
|
for i, info := range infos {
|
|
infos[i] = wrappedFileInfo{
|
|
subFolder: w.subFolder,
|
|
FileInfo: info,
|
|
}
|
|
}
|
|
return infos, err
|
|
}
|
|
|
|
func (w wrappedFile) Stat() (fs.FileInfo, error) {
|
|
info, err := w.File.Stat()
|
|
info = wrappedFileInfo{
|
|
subFolder: w.subFolder,
|
|
FileInfo: info,
|
|
}
|
|
return info, err
|
|
}
|
|
|
|
type wrappedFileInfo struct {
|
|
subFolder *string
|
|
fs.FileInfo
|
|
}
|
|
|
|
func (w wrappedFileInfo) Name() string {
|
|
name := w.FileInfo.Name()
|
|
return strings.TrimPrefix(name, *w.subFolder)
|
|
}
|
|
|
|
func (w wrappedFileInfo) ETag(ctx context.Context) (string, error) {
|
|
etag, _ := w.FileInfo.(webdav.ETager).ETag(ctx)
|
|
if len(etag) == 0 {
|
|
return etag, webdav.ErrNotImplemented
|
|
}
|
|
return etag, nil
|
|
}
|