Merge pull request #724 from ue-foundation/lm/restrict-reads-to-project

Restrict filesystem reads in snapshot to paths under project root

1 files changed, 32 insertions, 4 deletions

diff --git a/src/zenserver/storage/projectstore/httpprojectstore.cpp b/src/zenserver/storage/projectstore/httpprojectstore.cpp
index 4e947f221..86b4d7100 100644
--- a/src/zenserver/storage/projectstore/httpprojectstore.cpp
+++ b/src/zenserver/storage/projectstore/httpprojectstore.cpp
@@ -2880,6 +2880,8 @@ HttpProjectService::HandleRpcRequest(HttpRouterRequest& Req)
 				};
 				tsl::robin_map<IoHash, AddedChunk, IoHash::Hasher> AddedChunks;
 
+				const std::filesystem::path CanonicalRoot = std::filesystem::canonical(Project->RootDir);
+
 				Oplog->IterateOplog(
 					[&](CbObjectView Op) {
 						bool OpRewritten = false;
@@ -2898,10 +2900,36 @@ HttpProjectService::HandleRpcRequest(HttpRouterRequest& Req)
 
 								if (DataHash == IoHash::Zero)
 								{
-									std::string_view	  ServerPath = View["serverpath"sv].AsString();
-									std::filesystem::path FilePath	 = Project->RootDir / ServerPath;
-									BasicFile			  DataFile;
-									std::error_code		  Ec;
+									std::string_view ServerPath = View["serverpath"sv].AsString();
+									if (CanonicalRoot.empty())
+									{
+										ZEN_WARN("Attempting to load file '{}' from project with unset project root", ServerPath);
+										AllOk = false;
+										continue;
+									}
+
+									std::error_code				Ec;
+									const std::filesystem::path FilePath = std::filesystem::canonical(Project->RootDir / ServerPath, Ec);
+
+									if (Ec)
+									{
+										ZEN_WARN("Failed to find file '{}' in project root '{}' for 'snapshot'. Reason: '{}'",
+												 ServerPath,
+												 Project->RootDir,
+												 Ec.message());
+										AllOk = false;
+										continue;
+									}
+
+									if (std::mismatch(CanonicalRoot.begin(), CanonicalRoot.end(), FilePath.begin()).first !=
+										CanonicalRoot.end())
+									{
+										ZEN_WARN("Unable to read file '{}' outside of project root '{}'", FilePath, CanonicalRoot);
+										AllOk = false;
+										continue;
+									}
+
+									BasicFile DataFile;
 									DataFile.Open(FilePath, BasicFile::Mode::kRead, Ec);
 
 									if (Ec)