Dominik Schulz 7e4fa09665 security(fs): reject symlinked store entries escaping the store root (#3654) ...

safePath only performed a lexical prefix check, so a symlink inside the
store whose target lives outside the root passed validation. Get, Set,
Delete, Prune, Move, Link, LinkTarget, Exists and IsDir then acted on the
real target outside the store. List already resolved symlinks and skipped
escapes; that protection was missing from the read, write and delete paths.

Resolve the longest existing prefix of the requested path and verify the
real location stays within the store root. Walking up to the longest
existing prefix catches symlinked entries and intermediate directory
symlinks while still allowing paths whose trailing components do not exist
yet, e.g. when creating a new secret.

Fixes GHSA-v4c2-4fvx-chr3.

Signed-off-by: Dominik Schulz <dominik.schulz@gauner.org>

2026-10-10 07:15:17 +02:00

..

cryptfs

fix: require --age-sshkeys (or age.sshkeys config) to access ~/.ssh (#3525)

2026-08-21 19:07:53 +02:00

fossilfs

fix: highlight linked secrets in ls output (#3536)

2026-08-20 21:07:05 +02:00

fs

security(fs): reject symlinked store entries escaping the store root (#3654)

2026-10-10 07:15:17 +02:00

gitfs

fix: highlight linked secrets in ls output (#3536)

2026-08-20 21:07:05 +02:00

jjfs

fix: highlight linked secrets in ls output (#3536)

2026-08-20 21:07:05 +02:00

cryptfs.go

feat: Add cryptfs storage backend for filename encryption (#3249)

2025-09-24 08:47:09 +02:00

doc.go

[chore] Migrate to golangci-lint v2 (#3104)

2025-04-17 08:05:43 +02:00

fossilfs.go

Fossil support (#2092)

2022-01-10 17:29:04 +01:00

fs.go

Unexport more internal packages (#1377)

2020-05-22 18:26:01 +02:00

gitfs.go

Merge Storage and RCS backends into the Storage backend (#1455)

2020-07-19 21:32:53 +02:00

jjfs.go

[feat] Add Jujutsu storage backend (#3202)

2025-08-19 21:28:16 +02:00