kodi/podman-mvp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix (security): sluit path traversal in legacy /workloads/ endpoints

Browse Source 
Drie endpoints gebruikten os.path.join zonder validatie, waardoor een
aanvaller buiten WORKLOADS_DIR kon lezen/schrijven. Vervangen door de
bestaande _files_safe_join() helper die al door alle /files/ endpoints
werd gebruikt.

Endpoints: /workloads/read/, /workloads/save-file, /workloads/deploy/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
kodi
2026-03-22 09:52:27 +01:00
parent 2c5cb07cdb
commit bacab3b20a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
control/app_files.py
+3 -3
View File
@@ -44,7 +44,7 @@ def init_files_router(session, podman_api_base: str, workloads_dir: str) -> APIR
@router.get("/workloads/read/{filename:path}") @router.get("/workloads/read/{filename:path}")
def read_workload(filename: str): def read_workload(filename: str):
path = os.path.join(workloads_dir, filename) path = _files_safe_join(filename)
if not os.path.exists(path): if not os.path.exists(path):
raise HTTPException(404) raise HTTPException(404)
with open(path, 'r') as f: with open(path, 'r') as f:
@@ -55,7 +55,7 @@ def init_files_router(session, podman_api_base: str, workloads_dir: str) -> APIR
def save_workload_file(data: dict): def save_workload_file(data: dict):
path = data.get("path") path = data.get("path")
content = data.get("content") content = data.get("content")
full_path = os.path.join(workloads_dir, path) full_path = _files_safe_join(path)
os.makedirs(os.path.dirname(full_path), exist_ok=True) os.makedirs(os.path.dirname(full_path), exist_ok=True)
with open(full_path, "w") as f: with open(full_path, "w") as f:
f.write(content) f.write(content)
@@ -63,7 +63,7 @@ def init_files_router(session, podman_api_base: str, workloads_dir: str) -> APIR
@router.post("/workloads/deploy/{filename:path}") @router.post("/workloads/deploy/{filename:path}")
def deploy_workload(filename: str): def deploy_workload(filename: str):
path = os.path.join(workloads_dir, filename) path = _files_safe_join(filename)
with open(path, 'r') as f: with open(path, 'r') as f:
yaml_content = f.read() yaml_content = f.read()
url = f"{podman_api_base}/libpod/kube/play" url = f"{podman_api_base}/libpod/kube/play"