|
| 1 | +From 6622b002f70a153100d1c286fbcea721160da192 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Imre Rad <imrer@google.com> |
| 3 | +Date: Thu, 25 Apr 2024 14:21:51 +0000 |
| 4 | +Subject: [PATCH] gitRepo volume: directory must be max 1 level deep |
| 5 | + |
| 6 | +More details on Hackerone #2266560 |
| 7 | +--- |
| 8 | + pkg/volume/git_repo/git_repo.go | 6 ++++++ |
| 9 | + pkg/volume/git_repo/git_repo_test.go | 14 ++++++++++++++ |
| 10 | + 2 files changed, 20 insertions(+) |
| 11 | + |
| 12 | +diff --git a/pkg/volume/git_repo/git_repo.go b/pkg/volume/git_repo/git_repo.go |
| 13 | +index 995018d900727..b3827b92ad0f0 100644 |
| 14 | +--- a/pkg/volume/git_repo/git_repo.go |
| 15 | ++++ b/pkg/volume/git_repo/git_repo.go |
| 16 | +@@ -261,6 +261,12 @@ func validateVolume(src *v1.GitRepoVolumeSource) error { |
| 17 | + if err := validateNonFlagArgument(src.Directory, "directory"); err != nil { |
| 18 | + return err |
| 19 | + } |
| 20 | ++ if (src.Revision != "") && (src.Directory != "") { |
| 21 | ++ cleanedDir := filepath.Clean(src.Directory) |
| 22 | ++ if strings.Contains(cleanedDir, "/") || (strings.Contains(cleanedDir, "\\")) { |
| 23 | ++ return fmt.Errorf("%q is not a valid directory, it must not contain a directory separator", src.Directory) |
| 24 | ++ } |
| 25 | ++ } |
| 26 | + return nil |
| 27 | + } |
| 28 | + |
| 29 | +diff --git a/pkg/volume/git_repo/git_repo_test.go b/pkg/volume/git_repo/git_repo_test.go |
| 30 | +index 5b1461be892a1..650f765cc4884 100644 |
| 31 | +--- a/pkg/volume/git_repo/git_repo_test.go |
| 32 | ++++ b/pkg/volume/git_repo/git_repo_test.go |
| 33 | +@@ -267,6 +267,20 @@ func TestPlugin(t *testing.T) { |
| 34 | + }, |
| 35 | + isExpectedFailure: true, |
| 36 | + }, |
| 37 | ++ { |
| 38 | ++ name: "invalid-revision-directory-combo", |
| 39 | ++ vol: &v1.Volume{ |
| 40 | ++ Name: "vol1", |
| 41 | ++ VolumeSource: v1.VolumeSource{ |
| 42 | ++ GitRepo: &v1.GitRepoVolumeSource{ |
| 43 | ++ Repository: gitURL, |
| 44 | ++ Revision: "main", |
| 45 | ++ Directory: "foo/bar", |
| 46 | ++ }, |
| 47 | ++ }, |
| 48 | ++ }, |
| 49 | ++ isExpectedFailure: true, |
| 50 | ++ }, |
| 51 | + } |
| 52 | + |
| 53 | + for _, scenario := range scenarios { |
0 commit comments