FIX: add validation for containerID#726
Conversation
✅ Deploy Preview for urunc canceled.
|
|
Hey @cmainas what's your opinion on this comment #714 (comment) |
There was a problem hiding this comment.
Hi @kaizakin, I think two things to fix:
cmd/urunc/utils.go"path/filepath"is in the wrong import group (will fail CI lint)
path/filepath is stdlib it needs to go in the same group as the other stdlib imports, not in its own group between stdlib and external. goimports is enabled in golangci-lint v2 and is checked during golangci-lint run.
go.modrevert thefilepath-securejoinentry
github.com/cyphar/filepath-securejoin is not imported anywhere in the code , validateID only uses stdlib path/filepath. Looks like leftover from an earlier attempt. Revert the go.mod change.
The validation logic and placement look correct.
cc @cmainas
Signed-off-by: karthik balasubramanian <karthikbalasubramanian08@gmail.com>
kaizakin
force-pushed
the
fix/validate-containerid
branch
from
23636fd to
99fce71
Compare
|
Thanks for the review @mdryaan |
| // sends ACK to reexec process | ||
| func createUnikontainer(cmd *cli.Command, uruncCfg *unikontainers.UruncConfig) (err error) { | ||
| err = nil | ||
| containerID := cmd.Args().First() |
There was a problem hiding this comment.
The check for validateID should take place here, in order to catch the empty values too.
| if containerID == "" { | ||
| return nil, ErrEmptyContainerID | ||
| } | ||
| if err := validateID(containerID); err != nil { | ||
| return nil, err | ||
| } |
There was a problem hiding this comment.
We should merge these checks.
| } | ||
| return nil | ||
| } | ||
|
|
There was a problem hiding this comment.
Could you also add a comment citing the commit and file you used from the runc repo for this function?
3 participants
Description
containerIDvalidation following the similar approach asruncAlmost every command in urunc
delete,kill,ps,start,run, and the internal re-exec phase calls the sharedgetUnikontainer()helper function to read the container ID from the command line and load its state.by adding
validateIDinside this helper we've automatically secured all commands.only the
createcommand doesn't use the getUnikontainer() because the container state hasn't been initialized yetso i explicitly added validateId there.
How was this tested?
Manually tested by locally compiling urunc and simulating the path traversal attack vector
LLM usage
N/A
Checklist
make lint).make test_ctr,make test_nerdctl,make test_docker,make test_crictl).