IntenseWebs/grafana
3
0
Fork 0
mirror of https://github.com/grafana/grafana.git synced 2026-07-30 08:18:10 -05:00
Code Issues Packages Projects Releases Wiki Activity

Plugins: Improved handling of symlinks (#51324)

Browse Source 
Improves how we handle symlinks in plugin management.
This commit is contained in:
Marcus Efraimsson
2022-06-27 12:24:02 +02:00
committed by GitHub
parent bcc43aa0bc
commit 04df634ef5
3 changed files with 43 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/plugins/manager/installer/installer.go
+1 -1
View File
@@ -619,7 +619,7 @@ func isSymlinkRelativeTo(basePath string, symlinkDestPath string, symlinkOrigPat
return false
}
if strings.HasPrefix(p, ".."+string(filepath.Separator)) {
if p == ".." || strings.HasPrefix(p, ".."+string(filepath.Separator)) {
return false
}
}
pkg/plugins/manager/installer/installer_test.go
+28
View File
@@ -280,6 +280,34 @@ func TestIsSymlinkRelativeTo(t *testing.T) {
symlinkOrigPath: "/dir/sub-dir/test1.txt",
expected: false,
},
{
desc: "Symbolic link pointing to relative file outside basePath should return false",
basePath: "/dir",
symlinkDestPath: "../../",
symlinkOrigPath: "/dir/sub-sir/symlink.txt",
expected: false,
},
{
desc: "Symbolic link pointing to relative file outside basePath should return false",
basePath: "/dir",
symlinkDestPath: "../..",
symlinkOrigPath: "/dir/sub-sir/symlink.txt",
expected: false,
},
{
desc: "Symbolic link pointing to relative file outside basePath should return false",
basePath: "/dir",
symlinkDestPath: "../../",
symlinkOrigPath: "/dir/sub-sir/",
expected: false,
},
{
desc: "Symbolic link pointing to relative file outside basePath should return false",
basePath: "/dir",
symlinkDestPath: "../..",
symlinkOrigPath: "/dir/sub-sir/",
expected: false,
},
}
for _, tc := range tcs {
pkg/plugins/manager/signature/manifest.go
+14 -14
View File
@@ -108,6 +108,14 @@ func Calculate(mlog log.Logger, plugin *plugins.Plugin) (plugins.Signature, erro
}, nil
}
pluginFiles, err := pluginFilesRequiringVerification(plugin)
if err != nil {
mlog.Warn("Could not collect plugin file information in directory", "pluginID", plugin.ID, "dir", plugin.PluginDir)
return plugins.Signature{
Status: plugins.SignatureInvalid,
}, err
}
manifestPath := filepath.Join(plugin.PluginDir, "MANIFEST.txt")
// nolint:gosec
@@ -183,14 +191,6 @@ func Calculate(mlog log.Logger, plugin *plugins.Plugin) (plugins.Signature, erro
}
if manifest.isV2() {
pluginFiles, err := pluginFilesRequiringVerification(plugin)
if err != nil {
mlog.Warn("Could not collect plugin file information in directory", "pluginID", plugin.ID, "dir", plugin.PluginDir)
return plugins.Signature{
Status: plugins.SignatureInvalid,
}, err
}
// Track files missing from the manifest
var unsignedFiles []string
for _, f := range pluginFiles {
@@ -263,19 +263,19 @@ func pluginFilesRequiringVerification(plugin *plugins.Plugin) ([]string, error)
return err
}
// skip symlink directories
if symlink.IsDir() {
return nil
}
// verify that symlinked file is within plugin directory
p, err := filepath.Rel(plugin.PluginDir, symlinkPath)
if err != nil {
return err
}
if strings.HasPrefix(p, ".."+string(filepath.Separator)) {
if p == ".." || strings.HasPrefix(p, ".."+string(filepath.Separator)) {
return fmt.Errorf("file '%s' not inside of plugin directory", p)
}
// skip adding symlinked directories
if symlink.IsDir() {
return nil
}
}
// skip directories and MANIFEST.txt