97 lines
3.1 KiB
Go
97 lines
3.1 KiB
Go
//go:build windows
|
|
|
|
package safeio
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"golang.org/x/sys/windows"
|
|
)
|
|
|
|
const windowsRetainedHandleShareMode uint32 = windows.FILE_SHARE_READ | windows.FILE_SHARE_WRITE
|
|
|
|
// ReadCanonicalRegular opens each component with FILE_FLAG_OPEN_REPARSE_POINT and rejects a
|
|
// reparse point on the opened handle before opening the next component. Retained handles allow
|
|
// ordinary read/write sharing but deny delete sharing, which blocks rename or deletion after a
|
|
// component is opened and throughout the final read. Windows' Win32 API does not expose a
|
|
// portable descriptor-relative equivalent of POSIX openat, so a hostile local actor can still
|
|
// replace a not-yet-opened normal component between absolute-path opens. Installation directories
|
|
// therefore need trusted local filesystem/ACL ownership on Windows.
|
|
func ReadCanonicalRegular(path string, maximum int64) ([]byte, error) {
|
|
if err := ValidateCanonicalPath(path); err != nil {
|
|
return nil, err
|
|
}
|
|
volume := filepath.VolumeName(path)
|
|
root := volume + string(filepath.Separator)
|
|
components := strings.Split(strings.TrimPrefix(path, root), string(filepath.Separator))
|
|
if volume == "" || len(components) == 0 || components[0] == "" {
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
|
|
current := root
|
|
parents := make([]windows.Handle, 0, len(components)-1)
|
|
defer func() { closeWindowsHandles(parents) }()
|
|
for _, component := range components[:len(components)-1] {
|
|
current = filepath.Join(current, component)
|
|
handle, err := openWindowsComponent(current, true)
|
|
if err != nil {
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
parents = append(parents, handle)
|
|
}
|
|
|
|
current = filepath.Join(current, components[len(components)-1])
|
|
handle, err := openWindowsComponent(current, false)
|
|
if err != nil {
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
file := os.NewFile(uintptr(handle), "tht-safeio")
|
|
if file == nil {
|
|
windows.CloseHandle(handle)
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
defer file.Close()
|
|
return readBoundedRegularFile(path, file, maximum)
|
|
}
|
|
|
|
func openWindowsComponent(path string, directory bool) (windows.Handle, error) {
|
|
flags := uint32(windows.FILE_FLAG_OPEN_REPARSE_POINT)
|
|
if directory {
|
|
flags |= windows.FILE_FLAG_BACKUP_SEMANTICS
|
|
} else {
|
|
flags |= windows.FILE_ATTRIBUTE_NORMAL
|
|
}
|
|
handle, err := windows.CreateFile(
|
|
windows.StringToUTF16Ptr(path),
|
|
windows.GENERIC_READ,
|
|
windowsRetainedHandleShareMode,
|
|
nil,
|
|
windows.OPEN_EXISTING,
|
|
flags,
|
|
0,
|
|
)
|
|
if err != nil {
|
|
return 0, err
|
|
}
|
|
var information windows.ByHandleFileInformation
|
|
if err := windows.GetFileInformationByHandle(handle, &information); err != nil {
|
|
windows.CloseHandle(handle)
|
|
return 0, err
|
|
}
|
|
if information.FileAttributes&windows.FILE_ATTRIBUTE_REPARSE_POINT != 0 ||
|
|
(directory && information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY == 0) ||
|
|
(!directory && (information.FileAttributes&windows.FILE_ATTRIBUTE_DIRECTORY != 0 || information.NumberOfLinks != 1)) {
|
|
windows.CloseHandle(handle)
|
|
return 0, ErrUnsafeFile
|
|
}
|
|
return handle, nil
|
|
}
|
|
|
|
func closeWindowsHandles(handles []windows.Handle) {
|
|
for _, handle := range handles {
|
|
windows.CloseHandle(handle)
|
|
}
|
|
}
|