From 40aa894401912a84a8d4f48de83f37a1b6c3801a Mon Sep 17 00:00:00 2001
From: Stefan Boberg <stefan@boberg.org>
Date: Sat, 21 Mar 2026 20:56:52 +0100
Subject: Add ILocalRefPolicy to validate local file reference paths against
 data root

Restrict local-ref file paths to the server's data directories to prevent
a local process from reading arbitrary files via crafted local references.
The policy uses weakly_canonical + prefix matching (fail-closed when no
policy is configured). Handle-based refs bypass the policy since they
rely on OS handle security.
---
 src/zenhttp/httpserver.cpp | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

(limited to 'src/zenhttp/httpserver.cpp')

diff --git a/src/zenhttp/httpserver.cpp b/src/zenhttp/httpserver.cpp
index d15ef7a00..ead89eb58 100644
--- a/src/zenhttp/httpserver.cpp
+++ b/src/zenhttp/httpserver.cpp
@@ -485,6 +485,12 @@ HttpService::AcceptsLocalFileReferences() const
 	return false;
 }
 
+const ILocalRefPolicy*
+HttpService::GetLocalRefPolicy() const
+{
+	return nullptr;
+}
+
 //////////////////////////////////////////////////////////////////////////
 
 HttpServerRequest::HttpServerRequest(HttpService& Service) : m_Service(Service)
@@ -713,7 +719,8 @@ HttpServerRequest::ReadPayloadPackage()
 	{
 		ParseFlags Flags =
 			(IsLocalMachineRequest() && m_Service.AcceptsLocalFileReferences()) ? ParseFlags::kAllowLocalReferences : ParseFlags::kDefault;
-		return ParsePackageMessage(std::move(Payload), {}, Flags);
+		const ILocalRefPolicy* Policy = EnumHasAllFlags(Flags, ParseFlags::kAllowLocalReferences) ? m_Service.GetLocalRefPolicy() : nullptr;
+		return ParsePackageMessage(std::move(Payload), {}, Flags, Policy);
 	}
 
 	return {};
@@ -1267,10 +1274,12 @@ HandlePackageOffers(HttpService& Service, HttpServerRequest& Request, Ref<IHttpP
 					return PackageHandlerRef->CreateTarget(Cid, Size);
 				};
 
-				ParseFlags PkgFlags = (Request.IsLocalMachineRequest() && Service.AcceptsLocalFileReferences())
-										  ? ParseFlags::kAllowLocalReferences
-										  : ParseFlags::kDefault;
-				CbPackage  Package	= ParsePackageMessage(Request.ReadPayload(), CreateBuffer, PkgFlags);
+				ParseFlags			   PkgFlags = (Request.IsLocalMachineRequest() && Service.AcceptsLocalFileReferences())
+													  ? ParseFlags::kAllowLocalReferences
+													  : ParseFlags::kDefault;
+				const ILocalRefPolicy* PkgPolicy =
+					EnumHasAllFlags(PkgFlags, ParseFlags::kAllowLocalReferences) ? Service.GetLocalRefPolicy() : nullptr;
+				CbPackage Package = ParsePackageMessage(Request.ReadPayload(), CreateBuffer, PkgFlags, PkgPolicy);
 
 				PackageHandlerRef->OnRequestComplete();
 			}
-- 
cgit v1.2.3