MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-13 07:53:21 -05:00
Code Issues Packages Projects Releases Wiki Activity

avoid busy loops in bad path component (#19466)

Browse Source 
use it in places where we are looking
for such bad path components.
This commit is contained in:
Harshavardhana 2024-04-10 18:08:52 -07:00 committed by GitHub
parent 35d8728990
commit 9b926f7dbe
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
cmd/admin-handlers.go
View File

@ -36,6 +36,7 @@ import (
"net/url" "net/url"
"os" "os"
"path" "path"
"path/filepath"
"regexp" "regexp"
"runtime" "runtime"
"sort" "sort"
@ -3172,11 +3173,11 @@ func (a adminAPIHandlers) InspectDataHandler(w http.ResponseWriter, r *http.Requ
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL)
return return
} }
file = strings.ReplaceAll(file, string(os.PathSeparator), "/")
file = filepath.ToSlash(file)
// Reject attempts to traverse parent or absolute paths. // Reject attempts to traverse parent or absolute paths.
if strings.Contains(file, "..") || strings.Contains(volume, "..") { if hasBadPathComponent(volume) || hasBadPathComponent(file) {
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAccessDenied), r.URL) writeErrorResponse(r.Context(), w, errorCodes.ToAPIErr(ErrInvalidResourceName), r.URL)
return return
} }

7
cmd/generic-handlers.go
View File

@ -310,6 +310,13 @@ func hasBadHost(host string) error {
// Check if the incoming path has bad path components, // Check if the incoming path has bad path components,
// such as ".." and "." // such as ".." and "."
func hasBadPathComponent(path string) bool { func hasBadPathComponent(path string) bool {
if len(path) > 4096 {
// path cannot be greater than Linux PATH_MAX
// this is to avoid a busy loop, that can happen
// if the caller sends path of following style
// a/a/a/a/a/a/a/a...
return true
}
path = filepath.ToSlash(strings.TrimSpace(path)) // For windows '\' must be converted to '/' path = filepath.ToSlash(strings.TrimSpace(path)) // For windows '\' must be converted to '/'
for _, p := range strings.Split(path, SlashSeparator) { for _, p := range strings.Split(path, SlashSeparator) {
switch strings.TrimSpace(p) { switch strings.TrimSpace(p) {