From 5ea950075d6bce2b44fa18948b5b2113a1a4298c Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Sat, 16 Oct 2021 13:39:56 +0200 Subject: [PATCH 1/2] scaffolder-backend: extra safety around resolving source paths Signed-off-by: Patrik Oldsberg --- .../src/scaffolder/actions/builtin/publish/util.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts index dea180dc04..58ba5bfdd1 100644 --- a/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts +++ b/plugins/scaffolder-backend/src/scaffolder/actions/builtin/publish/util.ts @@ -15,6 +15,7 @@ */ import { InputError } from '@backstage/errors'; +import { isChildPath } from '@backstage/backend-common'; import { join as joinPath, normalize as normalizePath } from 'path'; import { ScmIntegrationRegistry } from '@backstage/integration'; @@ -27,7 +28,11 @@ export const getRepoSourceDirectory = ( /^(\.\.(\/|\\|$))+/, '', ); - return joinPath(workspacePath, safeSuffix); + const path = joinPath(workspacePath, safeSuffix); + if (!isChildPath(workspacePath, path)) { + throw new Error('Invalid source path'); + } + return path; } return workspacePath; }; From 6968962c920508eae19a4c1c200fa2c8980a4006 Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Sat, 16 Oct 2021 14:00:24 +0200 Subject: [PATCH 2/2] scaffolder-backend: release path traversal fix Signed-off-by: Patrik Oldsberg --- .changeset/stale-poets-destroy.md | 6 ------ plugins/scaffolder-backend/CHANGELOG.md | 7 +++++++ plugins/scaffolder-backend/package.json | 2 +- 3 files changed, 8 insertions(+), 7 deletions(-) delete mode 100644 .changeset/stale-poets-destroy.md diff --git a/.changeset/stale-poets-destroy.md b/.changeset/stale-poets-destroy.md deleted file mode 100644 index 71f8a478ec..0000000000 --- a/.changeset/stale-poets-destroy.md +++ /dev/null @@ -1,6 +0,0 @@ ---- -'@backstage/plugin-scaffolder-backend': patch ---- - -Make sure `sourcePath` of `publish:github:pull-request` can only be used to -retrieve files from the workspace. diff --git a/plugins/scaffolder-backend/CHANGELOG.md b/plugins/scaffolder-backend/CHANGELOG.md index 413c384929..160a0229d5 100644 --- a/plugins/scaffolder-backend/CHANGELOG.md +++ b/plugins/scaffolder-backend/CHANGELOG.md @@ -1,5 +1,12 @@ # @backstage/plugin-scaffolder-backend +## 0.15.9 + +### Patch Changes + +- 0f99f1170e: Make sure `sourcePath` of `publish:github:pull-request` can only be used to + retrieve files from the workspace. + ## 0.15.8 ### Patch Changes diff --git a/plugins/scaffolder-backend/package.json b/plugins/scaffolder-backend/package.json index 15f4cd40d2..05377123c0 100644 --- a/plugins/scaffolder-backend/package.json +++ b/plugins/scaffolder-backend/package.json @@ -1,7 +1,7 @@ { "name": "@backstage/plugin-scaffolder-backend", "description": "The Backstage backend plugin that helps you create new things", - "version": "0.15.8", + "version": "0.15.9", "main": "src/index.ts", "types": "src/index.ts", "license": "Apache-2.0",