delroth/hydra
0
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Helper/Nix: constructRunCommandLogPath: verify uuid is valid

Browse source 
This shouldn't be possible normally, but it is possible to:

    $db->resultset('RunCommandLogs')->new({ uuid => "../etc/passwd" });

if you have access to the `$db`.
This commit is contained in:
Cole Helbling 2022-01-28 12:45:12 -08:00
parent e381751564
commit 61189ecca9
3 changed files with 18 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/lib/Hydra/Controller/Root.pm
View file

@ -537,8 +537,10 @@ sub runcommandlog :Local :Args(1) {
die if defined $tail && $tail !~ /^[0-9]+$/;
my $runlog = $c->model('DB')->resultset('RunCommandLogs')->find({ uuid => $uuid });
my $logFile = constructRunCommandLogPath($runlog) or notFound($c, "RunCommandLog not found.");
my $runlog = $c->model('DB')->resultset('RunCommandLogs')->find({ uuid => $uuid })
or notFound($c, "The RunCommand log is not available.");
my $logFile = constructRunCommandLogPath($runlog);
if (-f $logFile) {
serveLogFile($c, $logFile, $tail);
return;

16
src/lib/Hydra/Helper/Nix.pm
View file

@ -13,6 +13,7 @@ use Nix::Store;
use Encode;
use Sys::Hostname::Long;
use IPC::Run;
use UUID4::Tiny qw(is_uuid4_string);
our @ISA = qw(Exporter);
our @EXPORT = qw(
@ -592,17 +593,16 @@ sub isLocalStore {
sub constructRunCommandLogPath {
my ($runlog) = @_;
my $path = undef;
my $uuid = $runlog->uuid;
eval {
my $uuid = $runlog->uuid;
my $hydra_path = Hydra::Model::DB::getHydraPath;
my $bucket = substr($uuid, 0, 2);
if (!is_uuid4_string($uuid)) {
die "UUID was invalid."
}
$path = "$hydra_path/runcommand-logs/$bucket/$uuid";
};
my $hydra_path = Hydra::Model::DB::getHydraPath;
my $bucket = substr($uuid, 0, 2);
return $path;
return "$hydra_path/runcommand-logs/$bucket/$uuid";
}
1;

6
t/Hydra/Helper/Nix.t
View file

@ -82,6 +82,12 @@ subtest "constructRunCommandLogPath" => sub {
qr@/runcommand-logs/[0-9a-f]{2}/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}@,
"The constructed RunCommandLog path is sufficiently bucketed and UUID-like."
);
my $badlog = $db->resultset('RunCommandLogs')->new({ uuid => "../../../etc/passwd" });
ok(
dies { Hydra::Helper::Nix::constructRunCommandLogPath($badlog) },
"Expected invalid UUID to be rejected and not have a path constructed for it.",
);
};
done_testing;