Nick Craig-Wood
2b7d0b16ed
Move the archive entry name validation added for CVE-2026-59732 from
cmd/archive/extract into a new lib/sanitize package as sanitize.Path,
so the same check can be shared with the archive backend which mounts
archives as a filesystem.
sanitize.Path keeps the extract semantics - reject any name with a
".." path component, treating both "/" and "\" as separators - and
additionally cleans the name with path.Clean. This corrects two edge
cases in extract: a repeated "./" prefix ("././file.txt") is now fully
stripped rather than only the first, and a bare "." entry is now
treated as the archive root and skipped.
Add sanitize.Leaf, which rejects a name that is empty, ".", ".." or
contains a "/", for checking a single directory entry name read from
an archive.
The names handled are rclone remote paths, in which "/" is the only
separator and "\" an ordinary character, so Leaf does not reject a
backslash: making a name safe for its storage is the destination
backend's job (the local backend encodes "\" on Windows and refuses
paths which escape its root). Path's rejection of ".." between
backslashes is kept as defence in depth for extract.
66 lines
1.2 KiB
Go
66 lines
1.2 KiB
Go
//go:build !plan9
|
|
|
|
package extract
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestDestPath(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
dstDir string
|
|
expected string
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "sanitized name returned",
|
|
input: "./subdir/file.txt",
|
|
expected: "subdir/file.txt",
|
|
},
|
|
{
|
|
name: "joined onto destination directory",
|
|
input: "file.txt",
|
|
dstDir: "safe/prefix",
|
|
expected: "safe/prefix/file.txt",
|
|
},
|
|
{
|
|
name: "archive root entry skipped",
|
|
input: "./",
|
|
expected: "",
|
|
},
|
|
{
|
|
name: "leading dot-dot rejected",
|
|
input: "../etc/passwd",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "interior dot-dot rejected with destination",
|
|
input: "dir/../../escaped.txt",
|
|
dstDir: "safe/prefix",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "backslash dot-dot rejected",
|
|
input: `..\escaped.txt`,
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
got, err := destPath(tc.input, tc.dstDir)
|
|
if tc.wantErr {
|
|
require.Error(t, err)
|
|
return
|
|
}
|
|
require.NoError(t, err)
|
|
assert.Equal(t, tc.expected, got)
|
|
})
|
|
}
|
|
}
|