|
| 1 | +From e90f3034faa9a6a23131df5665570d221e3092f3 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Bhagyashri Pathak <bhapathak@microsoft.com> |
| 3 | +Date: Thu, 8 Aug 2024 10:27:21 +0530 |
| 4 | +Subject: [PATCH] CVE-2024-25620 patch |
| 5 | + |
| 6 | +--- |
| 7 | + vendor/helm.sh/helm/v3/pkg/chart/metadata.go | 4 ++++ |
| 8 | + .../helm.sh/helm/v3/pkg/chartutil/errors.go | 8 ++++++++ |
| 9 | + vendor/helm.sh/helm/v3/pkg/chartutil/save.go | 20 +++++++++++++++++++ |
| 10 | + .../helm/v3/pkg/lint/rules/chartfile.go | 4 ++++ |
| 11 | + 4 files changed, 36 insertions(+) |
| 12 | + |
| 13 | +diff --git a/vendor/helm.sh/helm/v3/pkg/chart/metadata.go b/vendor/helm.sh/helm/v3/pkg/chart/metadata.go |
| 14 | +index ae572ab..3834b4c 100644 |
| 15 | +--- a/vendor/helm.sh/helm/v3/pkg/chart/metadata.go |
| 16 | ++++ b/vendor/helm.sh/helm/v3/pkg/chart/metadata.go |
| 17 | +@@ -16,6 +16,7 @@ limitations under the License. |
| 18 | + package chart |
| 19 | + |
| 20 | + import ( |
| 21 | ++ "path/filepath" |
| 22 | + "strings" |
| 23 | + "unicode" |
| 24 | + |
| 25 | +@@ -110,6 +111,9 @@ func (md *Metadata) Validate() error { |
| 26 | + if md.Name == "" { |
| 27 | + return ValidationError("chart.metadata.name is required") |
| 28 | + } |
| 29 | ++ if md.Name != filepath.Base(md.Name) { |
| 30 | ++ return ValidationErrorf("chart.metadata.name %q is invalid", md.Name) |
| 31 | ++ } |
| 32 | + if md.Version == "" { |
| 33 | + return ValidationError("chart.metadata.version is required") |
| 34 | + } |
| 35 | +diff --git a/vendor/helm.sh/helm/v3/pkg/chartutil/errors.go b/vendor/helm.sh/helm/v3/pkg/chartutil/errors.go |
| 36 | +index fcdcc27..0a4046d 100644 |
| 37 | +--- a/vendor/helm.sh/helm/v3/pkg/chartutil/errors.go |
| 38 | ++++ b/vendor/helm.sh/helm/v3/pkg/chartutil/errors.go |
| 39 | +@@ -33,3 +33,11 @@ type ErrNoValue struct { |
| 40 | + } |
| 41 | + |
| 42 | + func (e ErrNoValue) Error() string { return fmt.Sprintf("%q is not a value", e.Key) } |
| 43 | ++ |
| 44 | ++type ErrInvalidChartName struct { |
| 45 | ++ Name string |
| 46 | ++} |
| 47 | ++ |
| 48 | ++func (e ErrInvalidChartName) Error() string { |
| 49 | ++ return fmt.Sprintf("%q is not a valid chart name", e.Name) |
| 50 | ++} |
| 51 | +diff --git a/vendor/helm.sh/helm/v3/pkg/chartutil/save.go b/vendor/helm.sh/helm/v3/pkg/chartutil/save.go |
| 52 | +index 2ce4edd..4ee9070 100644 |
| 53 | +--- a/vendor/helm.sh/helm/v3/pkg/chartutil/save.go |
| 54 | ++++ b/vendor/helm.sh/helm/v3/pkg/chartutil/save.go |
| 55 | +@@ -39,6 +39,10 @@ var headerBytes = []byte("+aHR0cHM6Ly95b3V0dS5iZS96OVV6MWljandyTQo=") |
| 56 | + // directory, writing the chart's contents to that subdirectory. |
| 57 | + func SaveDir(c *chart.Chart, dest string) error { |
| 58 | + // Create the chart directory |
| 59 | ++ err := validateName(c.Name()) |
| 60 | ++ if err != nil { |
| 61 | ++ return err |
| 62 | ++ } |
| 63 | + outdir := filepath.Join(dest, c.Name()) |
| 64 | + if fi, err := os.Stat(outdir); err == nil && !fi.IsDir() { |
| 65 | + return errors.Errorf("file %s already exists and is not a directory", outdir) |
| 66 | +@@ -149,6 +153,10 @@ func Save(c *chart.Chart, outDir string) (string, error) { |
| 67 | + } |
| 68 | + |
| 69 | + func writeTarContents(out *tar.Writer, c *chart.Chart, prefix string) error { |
| 70 | ++ err := validateName(c.Name()) |
| 71 | ++ if err != nil { |
| 72 | ++ return err |
| 73 | ++ } |
| 74 | + base := filepath.Join(prefix, c.Name()) |
| 75 | + |
| 76 | + // Pull out the dependencies of a v1 Chart, since there's no way |
| 77 | +@@ -242,3 +250,15 @@ func writeToTar(out *tar.Writer, name string, body []byte) error { |
| 78 | + _, err := out.Write(body) |
| 79 | + return err |
| 80 | + } |
| 81 | ++ |
| 82 | ++// If the name has directory name has characters which would change the location |
| 83 | ++// they need to be removed. |
| 84 | ++func validateName(name string) error { |
| 85 | ++ nname := filepath.Base(name) |
| 86 | ++ |
| 87 | ++ if nname != name { |
| 88 | ++ return ErrInvalidChartName{name} |
| 89 | ++ } |
| 90 | ++ |
| 91 | ++ return nil |
| 92 | ++} |
| 93 | +diff --git a/vendor/helm.sh/helm/v3/pkg/lint/rules/chartfile.go b/vendor/helm.sh/helm/v3/pkg/lint/rules/chartfile.go |
| 94 | +index b49f2ce..f8f033c 100644 |
| 95 | +--- a/vendor/helm.sh/helm/v3/pkg/lint/rules/chartfile.go |
| 96 | ++++ b/vendor/helm.sh/helm/v3/pkg/lint/rules/chartfile.go |
| 97 | +@@ -107,6 +107,10 @@ func validateChartName(cf *chart.Metadata) error { |
| 98 | + if cf.Name == "" { |
| 99 | + return errors.New("name is required") |
| 100 | + } |
| 101 | ++ name := filepath.Base(cf.Name) |
| 102 | ++ if name != cf.Name { |
| 103 | ++ return fmt.Errorf("chart name %q is invalid", cf.Name) |
| 104 | ++ } |
| 105 | + return nil |
| 106 | + } |
| 107 | + |
| 108 | +-- |
| 109 | +2.34.1 |
| 110 | + |
0 commit comments