Tighten path containment in Live Migration file route#367
Open
nvharikrishna wants to merge 2 commits into
Open
Tighten path containment in Live Migration file route#367nvharikrishna wants to merge 2 commits into
nvharikrishna wants to merge 2 commits into
Conversation
…based path traversal by validating that the canonical resolved path stays within the configured directory. Return clearer HTTP status codes - 400 for malformed URLs, 403 for symlink escapes, 404 for missing or excluded files - with consistent JSON error responses. Preserve operator-configured directory paths in exclusion matching and logs so behavior stays predictable when data dirs sit behind symlinks.
yifan-c
reviewed
Jul 7, 2026
Comment on lines
+66
to
+72
| /** | ||
| * Caches the canonical (symlinks resolved) form of each base directory keyed by its lexical | ||
| * path. Base directories come from {@link InstanceMetadata}, which is fixed at startup, so the | ||
| * canonical form is stable for the process lifetime. The set of distinct base directories is | ||
| * bounded by configuration (~5–10 per instance), so no eviction is required. | ||
| */ | ||
| private static final ConcurrentMap<Path, Path> BASE_DIR_CANONICAL = new ConcurrentHashMap<>(); |
Contributor
There was a problem hiding this comment.
I know that the LiveMigrationInstanceMetadataUtil is a static helper already. But the static map BASE_DIR_CANONICAL catches my attention. I have 2 suggestions.
- It is common in this project to inject util via guice. Can we do the same, instead of an unmanaged global object out side of guice?
- To harden the assumption on the size, can we set a size limit and emit warning if exceeding certain size (say 10) when inserting into the map.
Comment on lines
-146
to
+156
| rc.response().setStatusCode(HttpResponseStatus.NOT_FOUND.code()).end(); | ||
| rc.fail(wrapHttpException(HttpResponseStatus.BAD_REQUEST, e.getMessage(), e)); |
| { | ||
| throw new NoSuchFileException(resolvedPath.toString()); | ||
| } | ||
| Path canonical = resolvedPath.toRealPath(); |
Contributor
There was a problem hiding this comment.
looks like toRealPath already throws NoSuchFileException when the file does not exist. The above check is redundant.
@throws IOException – if the file does not exist or an I/O error occurs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Making this change as part of CEP-40.
CASSSIDECAR-479 Tightens the path check on the Live Migration file route so that symlinks inside a data directory cannot point to files outside the configured directory.
Earlier, the route only checked the URL text for .. patterns. That check does not catch symlinks, so a symlink within the data dir could still resolve to a file elsewhere on disk. The route now also resolves the path with toRealPath() and confirms the resolved path stays inside the configured base directory.