feat: thothctl workspace preprocessing CLI and file-ingress contracts (P2)

tools/thothctl/internal/safeio/files.go

@@ -1,4 +1,4 @@
-// Package safeio reads installation files without following symlinked path components.
+// Package safeio reads and writes local files without following symlinked path components.
 package safeio
 
 import (
@@ -7,6 +7,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"unicode/utf8"
 )
 
 var ErrUnsafeFile = errors.New("unsafe file")
@@ -19,17 +20,83 @@ func ValidateCanonicalPath(path string) error {
 	return nil
 }
 
-func readBoundedRegularFile(file *os.File, maximum int64) ([]byte, error) {
+func readBoundedRegularFile(path string, file *os.File, maximum int64) ([]byte, error) {
 	if maximum < 0 || maximum == int64(^uint64(0)>>1) {
 		return nil, ErrUnsafeFile
 	}
 	info, err := file.Stat()
-	if err != nil || !info.Mode().IsRegular() {
+	if err != nil || !info.Mode().IsRegular() || !hasSingleLink(info) {
 		return nil, ErrUnsafeFile
 	}
 	contents, err := io.ReadAll(io.LimitReader(file, maximum+1))
 	if err != nil || int64(len(contents)) > maximum {
 		return nil, ErrUnsafeFile
 	}
+	after, err := file.Stat()
+	if err != nil || !after.Mode().IsRegular() || !hasSingleLink(after) || !os.SameFile(info, after) {
+		return nil, ErrUnsafeFile
+	}
+	current, err := os.Stat(path)
+	if err != nil || !os.SameFile(info, current) {
+		return nil, ErrUnsafeFile
+	}
 	return contents, nil
 }
+
+func ReadCanonicalUTF8(path string, maximum int64) (string, error) {
+	contents, err := ReadCanonicalRegular(path, maximum)
+	if err != nil {
+		return "", err
+	}
+	if !utf8.Valid(contents) {
+		return "", ErrUnsafeFile
+	}
+	return string(contents), nil
+}
+
+func WriteCanonicalNewFile(path string, contents []byte, mode os.FileMode) error {
+	if err := ValidateCanonicalPath(path); err != nil {
+		return err
+	}
+	parent := filepath.Dir(path)
+	if err := requireCanonicalDirectory(parent); err != nil {
+		return err
+	}
+	if info, err := os.Lstat(path); err == nil {
+		if !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || info.Mode()&os.ModeType != 0 {
+			return ErrUnsafeFile
+		}
+		return ErrUnsafeFile
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return ErrUnsafeFile
+	}
+	file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer file.Close()
+	if _, err := file.Write(contents); err != nil {
+		_ = os.Remove(path)
+		return ErrUnsafeFile
+	}
+	if err := file.Sync(); err != nil {
+		_ = os.Remove(path)
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func requireCanonicalDirectory(path string) error {
+	if err := ValidateCanonicalPath(path); err != nil {
+		return err
+	}
+	resolved, err := filepath.EvalSymlinks(path)
+	if err != nil || resolved != path {
+		return ErrUnsafeFile
+	}
+	info, err := os.Stat(path)
+	if err != nil || !info.IsDir() {
+		return ErrUnsafeFile
+	}
+	return nil
+}

tools/thothctl/internal/safeio/files_test.go

@@ -41,3 +41,55 @@ func TestReadCanonicalRegularRejectsFinalAndParentSymlinks(t *testing.T) {
 		t.Fatalf("final symlink error = %v, want ErrUnsafeFile", err)
 	}
 }
+
+func TestReadCanonicalUTF8RejectsNonUTF8AndHardlinks(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "thothctl-safeio-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+
+	nonUTF8 := filepath.Join(root, "annotations.yaml")
+	if err := os.WriteFile(nonUTF8, []byte{0xff, 0xfe, 0xfd}, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ReadCanonicalUTF8(nonUTF8, 1024); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("ReadCanonicalUTF8(nonUTF8) error = %v, want ErrUnsafeFile", err)
+	}
+
+	target := filepath.Join(root, "regular.txt")
+	if err := os.WriteFile(target, []byte("linked"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	link := filepath.Join(root, "hardlink.txt")
+	if err := os.Link(target, link); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ReadCanonicalUTF8(link, 1024); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("ReadCanonicalUTF8(hardlink) error = %v, want ErrUnsafeFile", err)
+	}
+}
+
+func TestWriteCanonicalNewFileRejectsExistingTargets(t *testing.T) {
+	temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	root, err := os.MkdirTemp(temporaryRoot, "thothctl-safeio-")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.RemoveAll(root) })
+
+	path := filepath.Join(root, "artifact.yaml")
+	if err := os.WriteFile(path, []byte("existing"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := WriteCanonicalNewFile(path, []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
+		t.Fatalf("WriteCanonicalNewFile(existing) error = %v, want ErrUnsafeFile", err)
+	}
+}

tools/thothctl/internal/safeio/files_unix.go

@@ -47,7 +47,7 @@ func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
 		return nil, ErrUnsafeFile
 	}
 	defer file.Close()
-	return readBoundedRegularFile(file, maximum)
+	return readBoundedRegularFile(path, file, maximum)
 }
 
 func closeUnixDescriptors(descriptors []int) {

tools/thothctl/internal/safeio/files_windows.go

@@ -53,7 +53,7 @@ func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
 		return nil, ErrUnsafeFile
 	}
 	defer file.Close()
-	return readBoundedRegularFile(file, maximum)
+	return readBoundedRegularFile(path, file, maximum)
 }
 
 func openWindowsComponent(path string, directory bool) (windows.Handle, error) {

tools/thothctl/internal/safeio/linkcount_unix.go

@@ -0,0 +1,13 @@
+//go:build !windows
+
+package safeio
+
+import (
+	"os"
+	"syscall"
+)
+
+func hasSingleLink(info os.FileInfo) bool {
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	return ok && stat.Nlink == 1
+}

tools/thothctl/internal/safeio/linkcount_windows.go

@@ -0,0 +1,9 @@
+//go:build windows
+
+package safeio
+
+import "os"
+
+func hasSingleLink(info os.FileInfo) bool {
+	return true
+}