Use descriptor-relative no-follow writes for destination confinement #205
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Severity
High
Description
Destination containment is checked before file creation, but fopen/rename can follow a destination symlink or race with replacement of a validated directory component. A local attacker can redirect synchronized content outside the configured root. Safe-links validation also rejects absolute links without resolving relative targets against the containing directory.
Location
Validation
Create destination/file as a symlink to an external target and transfer in-place; separately race a validated path component with a symlink. For safe-links, create source/sub/link -> ../../outside and scan with link-following options.
Suggested implementation
Use openat/openat2-style descriptor-relative traversal with O_NOFOLLOW, secure temporary creation and renameat within trusted directories, and canonical containment checks for resolved relative link targets. Add race-resistant filesystem tests.