CreateActorTemplate accepts path traversal sequences (e.g. ../../traversal-escape) and absolute paths (e.g. /escaped) in ActorMetadataItem.path and TrustBundleDataSource.path.
The failure mode is that the ActorTemplate is created but the golden actor is stuck in RESUMING state.
kubectl ate resume actor af840fb9-b58e-478b-8b87-ef0400d8c29b -a ate-golden
Error: failed to resume actor: rpc error: code = Internal desc = while populating system-info volume "sys-info": invalid system-info path "../../traversal-escape": must not contain empty, '.', or '..' segments
Note that we have some defense in depth in atelet to prevent path traversal so this is not a security issue. We should add a validation to shift-left the error to the time when the ActorTemplate resource is created though.
CreateActorTemplateaccepts path traversal sequences (e.g.../../traversal-escape) and absolute paths (e.g./escaped) inActorMetadataItem.pathandTrustBundleDataSource.path.The failure mode is that the ActorTemplate is created but the golden actor is stuck in
RESUMINGstate.Note that we have some defense in depth in atelet to prevent path traversal so this is not a security issue. We should add a validation to shift-left the error to the time when the ActorTemplate resource is created though.