mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat(auth): add safe Argon2id local user registry

Browse Source
This commit is contained in:
marcopan
2026-08-16 18:24:20 +02:00
parent f99bddcdf0
commit f6e4dbcae2
16 changed files with 1269 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/safeio/files.go
+22 -2
View File
@@ -2,6 +2,8 @@
package safeio
import (
"crypto/rand"
"encoding/hex"
"errors"
"io"
"os"
@@ -36,8 +38,8 @@ func readBoundedRegularFile(path string, file *os.File, maximum int64) ([]byte,
if err != nil || !after.Mode().IsRegular() || !hasSingleLink(after) || !os.SameFile(info, after) {
return nil, ErrUnsafeFile
}
current, err := os.Stat(path)
if err != nil || !os.SameFile(info, current) {
current, err := os.Lstat(path)
if err != nil || !current.Mode().IsRegular() || current.Mode()&os.ModeSymlink != 0 || !hasSingleLink(current) || !os.SameFile(info, current) {
return nil, ErrUnsafeFile
}
return contents, nil
@@ -86,6 +88,24 @@ func WriteCanonicalNewFile(path string, contents []byte, mode os.FileMode) error
return nil
}
// ReplaceCanonicalRegular durably replaces one existing private regular file without following
// symlinked path components. Platform implementations keep the temporary file in the target
// directory and use the platform's atomic replace primitive.
func ReplaceCanonicalRegular(path string, contents []byte, mode os.FileMode) error {
if err := ValidateCanonicalPath(path); err != nil || mode.Perm() != 0o600 || mode&os.ModeType != 0 {
return ErrUnsafeFile
}
return replaceCanonicalRegular(path, contents)
}
func randomTemporaryName() (string, error) {
bytes := make([]byte, 16)
if _, err := rand.Read(bytes); err != nil {
return "", err
}
return ".tht-auth-" + hex.EncodeToString(bytes) + ".tmp", nil
}
func requireCanonicalDirectory(path string) error {
if err := ValidateCanonicalPath(path); err != nil {
return err
tools/tht/internal/safeio/files_unix_test.go
+77
View File
@@ -30,3 +30,80 @@ func TestReadCanonicalRegularRejectsNamedPipeWithoutBlocking(t *testing.T) {
t.Fatalf("named pipe error = %v, want ErrUnsafeFile", err)
}
}
func TestReplaceCanonicalRegularReplacesOnlySafeRegularTargets(t *testing.T) {
temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
if err != nil {
t.Fatal(err)
}
root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = os.RemoveAll(root) })
path := filepath.Join(root, "users.yaml")
if err := os.WriteFile(path, []byte("old"), 0o600); err != nil {
t.Fatal(err)
}
if err := ReplaceCanonicalRegular(path, []byte("new"), 0o600); err != nil {
t.Fatal(err)
}
contents, err := ReadCanonicalRegular(path, 1024)
if err != nil {
t.Fatal(err)
}
if string(contents) != "new" {
t.Fatalf("replacement content = %q, want new", contents)
}
info, err := os.Stat(path)
if err != nil {
t.Fatal(err)
}
if info.Mode().Perm() != 0o600 {
t.Fatalf("replacement mode = %o, want 600", info.Mode().Perm())
}
linked := filepath.Join(root, "linked.yaml")
if err := os.Link(path, linked); err != nil {
t.Fatal(err)
}
if err := ReplaceCanonicalRegular(path, []byte("unsafe"), 0o600); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("hard-linked replacement error = %v, want ErrUnsafeFile", err)
}
}
func TestReplaceCanonicalRegularRejectsSymlinkedPathComponents(t *testing.T) {
temporaryRoot, err := filepath.EvalSymlinks(os.TempDir())
if err != nil {
t.Fatal(err)
}
root, err := os.MkdirTemp(temporaryRoot, "tht-safeio-replace-")
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() { _ = os.RemoveAll(root) })
realDirectory := filepath.Join(root, "real")
if err := os.Mkdir(realDirectory, 0o700); err != nil {
t.Fatal(err)
}
target := filepath.Join(realDirectory, "users.yaml")
if err := os.WriteFile(target, []byte("old"), 0o600); err != nil {
t.Fatal(err)
}
linkedDirectory := filepath.Join(root, "linked")
if err := os.Symlink(realDirectory, linkedDirectory); err != nil {
t.Fatal(err)
}
if err := ReplaceCanonicalRegular(filepath.Join(linkedDirectory, "users.yaml"), []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("parent symlink replacement error = %v, want ErrUnsafeFile", err)
}
linkedFile := filepath.Join(root, "linked-file.yaml")
if err := os.Symlink(target, linkedFile); err != nil {
t.Fatal(err)
}
if err := ReplaceCanonicalRegular(linkedFile, []byte("new"), 0o600); !errors.Is(err, ErrUnsafeFile) {
t.Fatalf("final symlink replacement error = %v, want ErrUnsafeFile", err)
}
}
tools/tht/internal/safeio/files_windows.go
+1 -1
View File
@@ -82,7 +82,7 @@ func openWindowsComponent(path string, directory bool) (windows.Handle, error) {
}
if information.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 ||
(directory && information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY == 0) ||
(!directory && information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0) {
(!directory && (information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0 || information.NumberOfLinks != 1)) {
windows.CloseHandle(handle)
return 0, ErrUnsafeFile
}
tools/tht/internal/safeio/files_windows_test.go
+4
View File
@@ -12,10 +12,14 @@ import (
const expectedWindowsRetainedHandleShareMode = windows.FILE_SHARE_READ | windows.FILE_SHARE_WRITE
const expectedWindowsReplaceMoveFlags = windows.MOVEFILE_REPLACE_EXISTING | windows.MOVEFILE_WRITE_THROUGH
// Keep this contract compile-enforced so Windows cross-test compilation catches a future
// FILE_SHARE_DELETE regression even when the tests are compiled on a non-Windows host.
var _ [windowsRetainedHandleShareMode - expectedWindowsRetainedHandleShareMode]struct{}
var _ [expectedWindowsRetainedHandleShareMode - windowsRetainedHandleShareMode]struct{}
var _ [windowsReplaceMoveFlags - expectedWindowsReplaceMoveFlags]struct{}
var _ [expectedWindowsReplaceMoveFlags - windowsReplaceMoveFlags]struct{}
func TestOpenWindowsComponentBlocksMutationWhileHandleIsRetained(t *testing.T) {
t.Run("parent rename", func(t *testing.T) {
tools/tht/internal/safeio/replace_unix.go
+114
View File
@@ -0,0 +1,114 @@
//go:build !windows
package safeio
import (
"errors"
"io"
"os"
"strings"
"golang.org/x/sys/unix"
)
func replaceCanonicalRegular(path string, contents []byte) error {
directory, target, err := openCanonicalParentDirectory(path)
if err != nil {
return ErrUnsafeFile
}
defer unix.Close(directory)
if err := requireSingleRegularAt(directory, target); err != nil {
return ErrUnsafeFile
}
temporary, err := writePrivateTemporaryAt(directory, contents)
if err != nil {
return ErrUnsafeFile
}
defer func() {
if temporary != "" {
_ = unix.Unlinkat(directory, temporary, 0)
}
}()
if err := requireSingleRegularAt(directory, target); err != nil {
return ErrUnsafeFile
}
if err := unix.Renameat(directory, temporary, directory, target); err != nil {
return ErrUnsafeFile
}
temporary = ""
if err := unix.Fsync(directory); err != nil {
return ErrUnsafeFile
}
return nil
}
func openCanonicalParentDirectory(path string) (int, string, error) {
components := strings.Split(strings.TrimPrefix(path, string(os.PathSeparator)), string(os.PathSeparator))
if len(components) < 2 || components[0] == "" || components[len(components)-1] == "" {
return -1, "", ErrUnsafeFile
}
directory, err := unix.Open(string(os.PathSeparator), unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY, 0)
if err != nil {
return -1, "", err
}
for _, component := range components[:len(components)-1] {
next, err := unix.Openat(directory, component, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY|unix.O_NOFOLLOW, 0)
if err != nil {
unix.Close(directory)
return -1, "", err
}
unix.Close(directory)
directory = next
}
return directory, components[len(components)-1], nil
}
func requireSingleRegularAt(directory int, name string) error {
var stat unix.Stat_t
if err := unix.Fstatat(directory, name, &stat, unix.AT_SYMLINK_NOFOLLOW); err != nil || stat.Mode&unix.S_IFMT != unix.S_IFREG || stat.Nlink != 1 {
return ErrUnsafeFile
}
return nil
}
func writePrivateTemporaryAt(directory int, contents []byte) (string, error) {
for attempt := 0; attempt < 16; attempt++ {
name, err := randomTemporaryName()
if err != nil {
return "", err
}
descriptor, err := unix.Openat(directory, name, unix.O_WRONLY|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
if errors.Is(err, unix.EEXIST) {
continue
}
if err != nil {
return "", err
}
file := os.NewFile(uintptr(descriptor), "tht-safeio-replacement")
if file == nil {
unix.Close(descriptor)
return "", ErrUnsafeFile
}
if err := file.Chmod(0o600); err == nil {
var written int
written, err = file.Write(contents)
if err == nil && written != len(contents) {
err = io.ErrShortWrite
}
}
if err == nil {
err = file.Sync()
}
closeErr := file.Close()
if err == nil {
err = closeErr
}
if err != nil {
_ = unix.Unlinkat(directory, name, 0)
return "", err
}
return name, nil
}
return "", ErrUnsafeFile
}
tools/tht/internal/safeio/replace_windows.go
+86
View File
@@ -0,0 +1,86 @@
//go:build windows
package safeio
import (
"errors"
"io"
"os"
"path/filepath"
"golang.org/x/sys/windows"
)
const windowsReplaceMoveFlags = windows.MOVEFILE_REPLACE_EXISTING | windows.MOVEFILE_WRITE_THROUGH
func replaceCanonicalRegular(path string, contents []byte) error {
directory := filepath.Dir(path)
if err := requireCanonicalDirectory(directory); err != nil || !safeExistingRegular(path) {
return ErrUnsafeFile
}
temporary, err := writePrivateTemporary(directory, contents)
if err != nil {
return ErrUnsafeFile
}
defer func() { _ = os.Remove(temporary) }()
if !safeExistingRegular(path) {
return ErrUnsafeFile
}
from, err := windows.UTF16PtrFromString(temporary)
if err != nil {
return ErrUnsafeFile
}
to, err := windows.UTF16PtrFromString(path)
if err != nil {
return ErrUnsafeFile
}
if err := windows.MoveFileEx(from, to, windowsReplaceMoveFlags); err != nil {
return ErrUnsafeFile
}
return nil
}
func safeExistingRegular(path string) bool {
handle, err := openWindowsComponent(path, false)
if err != nil {
return false
}
return windows.CloseHandle(handle) == nil
}
func writePrivateTemporary(directory string, contents []byte) (string, error) {
for attempt := 0; attempt < 16; attempt++ {
name, err := randomTemporaryName()
if err != nil {
return "", err
}
path := filepath.Join(directory, name)
file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
if errors.Is(err, os.ErrExist) {
continue
}
if err != nil {
return "", err
}
if err := file.Chmod(0o600); err == nil {
var written int
written, err = file.Write(contents)
if err == nil && written != len(contents) {
err = io.ErrShortWrite
}
}
if err == nil {
err = file.Sync()
}
closeErr := file.Close()
if err == nil {
err = closeErr
}
if err != nil {
_ = os.Remove(path)
return "", err
}
return path, nil
}
return "", ErrUnsafeFile
}