fix(cask): confine artifact sources to extraction roots - #843
Open
rustytrees wants to merge 2 commits into
Open
Conversation
Resolve cask binary and font sources before use, and reject any source whose canonical path leaves its extraction root. Reopen each path component without following symlinks so the checked object is the one copied, chmodded, or linked. Add regressions for external symlinks and prefix paths outside Caskroom while retaining internal symlink support.
Owner
|
@rustytrees Thanks for the contribution! One small request: could you please instruct your agent to follow the PR template provided in the repository for PRs? It helps keep the PRs consistent and easier to review. Thanks! |
Exercise nested relative binaries and in-version HOMEBREW_PREFIX paths through the confined source opener. Verify that each source becomes executable and that the prefix link points to its canonical Caskroom path.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Cask JSON controls the source paths for binary and font artifacts. Previously, a source symlink could resolve outside the extraction root. A font artifact could copy an external file into the managed fonts directory, while a binary artifact could change the mode of an external file and link it into the prefix. A
$HOMEBREW_PREFIXsource could also name a prefix file outside the cask's version directory.This change resolves each source and requires the result to remain inside its extraction root. It then reopens every path component and the file itself without following symlinks before copying, changing its mode, or linking it. Internal symlinks that resolve inside the extraction root still work. Font copies read from the verified open file handle and replace the destination atomically.
Related Issue
Closes #849.
Notes for Reviewers
The security regressions cover an outside binary symlink, an outside font symlink, a
$HOMEBREW_PREFIXsource outside the cask version directory, and a legitimate internal symlink. Before the fix, the first two tests failed andtest-onepassed 2,424 of 2,426 tests.A catalog follow-up also covers two normal binary shapes used by official casks: a nested relative path and an in-version
$HOMEBREW_PREFIX/Caskroom/...path. The test confirms that each regular source becomes executable and that the prefix symlink points to its canonical confined source.Verification after the follow-up completed with:
zig build: 8 of 8 steps succeededzig build test-one: 2,429 passedzig build test: 331 of 331 steps succeeded; 5,064 tests passed and 3 skipped; exit code 0zig fmt --check src/core/cask.ziggit verify-commit HEAD