|
 |
c6d517 |
From 840e7dad513b86f454573ad415701c0199f78d30 Mon Sep 17 00:00:00 2001
|
|
|
c6d517 |
From: TomSweeneyRedHat <tsweeney@redhat.com>
|
|
|
c6d517 |
Date: Tue, 24 Mar 2020 20:10:22 -0400
|
|
|
c6d517 |
Subject: [PATCH] Fix potential CVE in tarfile w/ symlink
|
|
|
c6d517 |
|
|
|
c6d517 |
Stealing @nalind 's workaround to avoid refetching
|
|
|
c6d517 |
content after a file read failure. Under the right
|
|
|
c6d517 |
circumstances that could be a symlink to a file meant
|
|
|
c6d517 |
to overwrite a good file with bad data.
|
|
|
c6d517 |
|
|
|
c6d517 |
Testing:
|
|
|
c6d517 |
```
|
|
|
c6d517 |
goodstuff
|
|
|
c6d517 |
|
|
|
c6d517 |
[1] 14901
|
|
|
c6d517 |
|
|
|
c6d517 |
127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
|
|
|
c6d517 |
127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
|
|
|
c6d517 |
no FROM statement found
|
|
|
c6d517 |
|
|
|
c6d517 |
goodstuff
|
|
|
c6d517 |
```
|
|
|
c6d517 |
|
|
|
c6d517 |
Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
|
|
|
c6d517 |
---
|
|
|
c6d517 |
imagebuildah/util.go | 5 +++--
|
|
|
c6d517 |
1 file changed, 3 insertions(+), 2 deletions(-)
|
|
|
c6d517 |
|
|
|
c6d517 |
diff --git a/imagebuildah/util.go b/imagebuildah/util.go
|
|
|
c6d517 |
index 29ea60970..5f14c9883 100644
|
|
|
c6d517 |
--- a/imagebuildah/util.go
|
|
|
c6d517 |
+++ b/imagebuildah/util.go
|
|
|
c6d517 |
@@ -14,6 +14,7 @@ import (
|
|
|
c6d517 |
|
|
|
c6d517 |
"github.com/containers/buildah"
|
|
|
c6d517 |
"github.com/containers/storage/pkg/chrootarchive"
|
|
|
c6d517 |
+ "github.com/containers/storage/pkg/ioutils"
|
|
|
c6d517 |
"github.com/opencontainers/runtime-spec/specs-go"
|
|
|
c6d517 |
"github.com/pkg/errors"
|
|
|
c6d517 |
"github.com/sirupsen/logrus"
|
|
|
c6d517 |
@@ -57,7 +58,7 @@ func downloadToDirectory(url, dir string) error {
|
|
|
c6d517 |
}
|
|
|
c6d517 |
dockerfile := filepath.Join(dir, "Dockerfile")
|
|
|
c6d517 |
// Assume this is a Dockerfile
|
|
|
c6d517 |
- if err := ioutil.WriteFile(dockerfile, body, 0600); err != nil {
|
|
|
c6d517 |
+ if err := ioutils.AtomicWriteFile(dockerfile, body, 0600); err != nil {
|
|
|
c6d517 |
return errors.Wrapf(err, "Failed to write %q to %q", url, dockerfile)
|
|
|
c6d517 |
}
|
|
|
c6d517 |
}
|
|
|
c6d517 |
@@ -75,7 +76,7 @@ func stdinToDirectory(dir string) error {
|
|
|
c6d517 |
if err := chrootarchive.Untar(reader, dir, nil); err != nil {
|
|
|
c6d517 |
dockerfile := filepath.Join(dir, "Dockerfile")
|
|
|
c6d517 |
// Assume this is a Dockerfile
|
|
|
c6d517 |
- if err := ioutil.WriteFile(dockerfile, b, 0600); err != nil {
|
|
|
c6d517 |
+ if err := ioutils.AtomicWriteFile(dockerfile, b, 0600); err != nil {
|
|
|
c6d517 |
return errors.Wrapf(err, "Failed to write bytes to %q", dockerfile)
|
|
|
c6d517 |
}
|
|
|
c6d517 |
}
|