Skip to content

SystemInfoVolumeSource accepts path traversal (e.g. ../) #1436

Description

CreateActorTemplate accepts path traversal sequences (e.g. ../../traversal-escape) and absolute paths (e.g. /escaped) in ActorMetadataItem.path and TrustBundleDataSource.path.

The failure mode is that the ActorTemplate is created but the golden actor is stuck in RESUMING state.

kubectl ate resume actor af840fb9-b58e-478b-8b87-ef0400d8c29b -a ate-golden

Error: failed to resume actor: rpc error: code = Internal desc = while populating system-info volume "sys-info": invalid system-info path "../../traversal-escape": must not contain empty, '.', or '..' segments

Note that we have some defense in depth in atelet to prevent path traversal so this is not a security issue. We should add a validation to shift-left the error to the time when the ActorTemplate resource is created though.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions