mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: define P2 host workspace command contract

Browse Source
This commit is contained in:
marcopan
2026-08-11 00:24:31 +02:00
parent 38c8398bc1
commit ccaf8c1be0
12 changed files with 808 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/thothctl/internal/safeio/files.go
+20
View File
@@ -4,9 +4,11 @@ package safeio
import (
"errors"
"io"
"io/fs"
"os"
"path/filepath"
"strings"
"unicode/utf8"
)
var ErrUnsafeFile = errors.New("unsafe file")
@@ -33,3 +35,21 @@ func readBoundedRegularFile(file *os.File, maximum int64) ([]byte, error) {
}
return contents, nil
}
// ReadCanonicalUTF8 reads a canonical regular file with a strict byte bound and UTF-8 validation.
func ReadCanonicalUTF8(path string, maximum int64) ([]byte, error) {
contents, err := ReadCanonicalRegular(path, maximum)
if err != nil || !utf8.Valid(contents) {
return nil, ErrUnsafeFile
}
return contents, nil
}
// WriteCanonicalExclusive creates a canonical regular file without following links or replacing
// an existing leaf. The file is private to the caller and is never opened in truncate mode.
func WriteCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
return writeCanonicalExclusive(path, contents, mode)
}
// ValidateCanonicalOutputPath verifies every parent directory without creating the leaf.
func ValidateCanonicalOutputPath(path string) error { return validateCanonicalOutputPath(path) }
tools/thothctl/internal/safeio/files_test.go
+34
View File
@@ -41,3 +41,37 @@ func TestReadCanonicalRegularRejectsFinalAndParentSymlinks(t *testing.T) {
t.Fatalf("final symlink error = %v, want ErrUnsafeFile", err)
}
}
func TestReadCanonicalUTF8RejectsNonUTF8AndBounds(t *testing.T) {
path := filepath.Join(t.TempDir(), "input.sql")
if err := os.WriteFile(path, []byte("\xff"), 0o600); err != nil {
t.Fatal(err)
}
if _, err := ReadCanonicalUTF8(path, 1024); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("ReadCanonicalUTF8 invalid UTF-8 = %v", err)
}
if err := os.WriteFile(path, []byte("12345"), 0o600); err != nil {
t.Fatal(err)
}
if _, err := ReadCanonicalUTF8(path, 4); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("ReadCanonicalUTF8 oversized = %v", err)
}
}
func TestWriteCanonicalExclusiveRejectsExistingAndCreatesPrivateFile(t *testing.T) {
root, err := filepath.EvalSymlinks(t.TempDir())
if err != nil {
t.Fatal(err)
}
path := filepath.Join(root, "candidate.yaml")
if err := WriteCanonicalExclusive(path, []byte("ok"), 0o600); err != nil {
t.Fatal(err)
}
contents, err := os.ReadFile(path)
if err != nil || string(contents) != "ok" {
t.Fatalf("output = %q, %v", contents, err)
}
if err := WriteCanonicalExclusive(path, []byte("replace"), 0o600); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("replacement = %v", err)
}
}
tools/thothctl/internal/safeio/files_unix.go
+86 -1
View File
@@ -3,6 +3,7 @@
package safeio
import (
"io/fs"
"os"
"strings"
@@ -47,7 +48,18 @@ func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
return nil, ErrUnsafeFile
}
defer file.Close()
return readBoundedRegularFile(file, maximum)
var before, after unix.Stat_t
if err := unix.Fstat(int(file.Fd()), &before); err != nil || before.Nlink > 1 || before.Mode&unix.S_IFMT != unix.S_IFREG {
return nil, ErrUnsafeFile
}
contents, err := readBoundedRegularFile(file, maximum)
if err != nil {
return nil, ErrUnsafeFile
}
if err := unix.Fstat(int(file.Fd()), &after); err != nil || after.Nlink > 1 || after.Mode != before.Mode || after.Ino != before.Ino || after.Dev != before.Dev || after.Size != before.Size {
return nil, ErrUnsafeFile
}
return contents, nil
}
func closeUnixDescriptors(descriptors []int) {
@@ -55,3 +67,76 @@ func closeUnixDescriptors(descriptors []int) {
unix.Close(descriptor)
}
}
func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
if err := ValidateCanonicalPath(path); err != nil || len(contents) > 16<<20 || mode.Perm() == 0 || mode.Perm()&0o077 != 0 {
return ErrUnsafeFile
}
components := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
if len(components) == 0 || components[0] == "" {
return ErrUnsafeFile
}
dir, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
if err != nil {
return ErrUnsafeFile
}
defer unix.Close(dir)
for _, component := range components[:len(components)-1] {
next, err := unix.Openat(dir, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
if err != nil {
return ErrUnsafeFile
}
unix.Close(dir)
dir = next
}
fd, err := unix.Openat(dir, components[len(components)-1], unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, uint32(mode.Perm()))
if err != nil {
return ErrUnsafeFile
}
f := os.NewFile(uintptr(fd), "thothctl-safeio-output")
if f == nil {
unix.Close(fd)
return ErrUnsafeFile
}
defer f.Close()
if err := f.Chmod(mode); err != nil {
return ErrUnsafeFile
}
if _, err := f.Write(contents); err != nil {
return ErrUnsafeFile
}
if err := f.Sync(); err != nil {
return ErrUnsafeFile
}
return nil
}
func validateCanonicalOutputPath(path string) error {
if err := ValidateCanonicalPath(path); err != nil {
return err
}
components := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
if len(components) < 2 || components[0] == "" {
return ErrUnsafeFile
}
dir, err := unix.Open("/", unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC, 0)
if err != nil {
return ErrUnsafeFile
}
defer unix.Close(dir)
for _, component := range components[:len(components)-1] {
next, err := unix.Openat(dir, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
if err != nil {
return ErrUnsafeFile
}
unix.Close(dir)
dir = next
}
var st unix.Stat_t
if err := unix.Fstatat(dir, components[len(components)-1], &st, unix.AT_SYMLINK_NOFOLLOW); err == nil {
return ErrUnsafeFile
} else if err != unix.ENOENT {
return ErrUnsafeFile
}
return nil
}
tools/thothctl/internal/safeio/files_windows.go
+46
View File
@@ -3,6 +3,7 @@
package safeio
import (
"io/fs"
"os"
"path/filepath"
"strings"
@@ -94,3 +95,48 @@ func closeWindowsHandles(handles []windows.Handle) {
windows.CloseHandle(handle)
}
}
func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
if err := ValidateCanonicalPath(path); err != nil || len(contents) > 16<<20 || mode.Perm() == 0 || mode.Perm()&0o077 != 0 {
return ErrUnsafeFile
}
h, err := windows.CreateFile(windows.StringToUTF16Ptr(path), windows.GENERIC_WRITE, 0, nil, windows.CREATE_NEW, windows.FILE_ATTRIBUTE_NORMAL|windows.FILE_FLAG_OPEN_REPARSE_POINT, 0)
if err != nil {
return ErrUnsafeFile
}
f := os.NewFile(uintptr(h), "thothctl-safeio-output")
if f == nil {
windows.CloseHandle(h)
return ErrUnsafeFile
}
defer f.Close()
if _, err := f.Write(contents); err != nil {
return ErrUnsafeFile
}
return f.Sync()
}
func validateCanonicalOutputPath(path string) error {
if err := ValidateCanonicalPath(path); err != nil {
return err
}
volume := filepath.VolumeName(path)
root := volume + string(filepath.Separator)
components := strings.Split(strings.TrimPrefix(path, root), string(filepath.Separator))
if volume == "" || len(components) < 2 || components[0] == "" {
return ErrUnsafeFile
}
current := root
for _, component := range components[:len(components)-1] {
current = filepath.Join(current, component)
h, err := openWindowsComponent(current, true)
if err != nil {
return ErrUnsafeFile
}
windows.CloseHandle(h)
}
if _, err := os.Lstat(filepath.Join(current, components[len(components)-1])); err == nil || !os.IsNotExist(err) {
return ErrUnsafeFile
}
return nil
}