You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@opendal.apache.org by "aysha-afrah26 (via GitHub)" <gi...@apache.org> on 2026/07/31 18:57:06 UTC
[PR] fix(services): reject absolute paths in confined_join and prepare_path [opendal]
aysha-afrah26 opened a new pull request, #8005:
URL: https://github.com/apache/opendal/pull/8005
# Which issue does this PR close?
<!--
We generally require a GitHub issue to be filed for all bug fixes and enhancements. You can link an issue to this PR using the GitHub syntax. For example `Closes #123` indicates that this PR will close issue #123.
-->
None
# Rationale for this change
<!--
Why are you proposing this change? If this is already explained clearly in the issue then this section is not needed.
Explaining clearly why changes are proposed helps reviewers understand your changes and offer better suggestions for fixes.
-->
RFC 7799 specifies the local filesystem root check as rejecting `Component::ParentDir`, `Component::RootDir` and `Component::Prefix(_)`, and gives the reason for the last two: they prevent absolute paths from replacing the root via `PathBuf::join`. The shipped guard matches only the `ParentDir` arm, so an absolute key walks straight through it and `root.join("/etc/passwd")` evaluates to `/etc/passwd`.
`Operator::delete_with` runs `normalize_path` first, which strips the leading `/`, so the single-path API is fine. `Deleter` does not: `Deleter::delete` passes the caller's key to the service verbatim. With an `Fs` operator rooted at a temp dir, `op.delete_iter(["<absolute path outside root>"])` deletes the target, and with `recursive` set it is `remove_dir_all`. `delete_try_iter`, `delete_stream`, `delete_try_stream` and the `Sink` impl all reach the same place. On Windows the exposure is not limited to delete: `normalize_path` only splits on `/`, so `C:/…`, a leading `\`, `\\?\…` and UNC paths survive it unchanged and are absolute to `std::path`, which escapes the root on every operation.
# What changes are included in this PR?
<!--
There is no need to duplicate the description in the issue here but it is sometimes worth providing a summary of the individual changes in this PR.
-->
Adds the two missing component arms to `FsCore::confined_join` and to the `prepare_path` copies in `compfs` and `monoiofs`, which carry the same guard. The error message loses its parent-dir wording and matches the RFC text, since the check now covers more than `..`.
Keeping the check inside the join helper means every caller is covered whether or not the path reached it through `normalize_path`, which is what the `Deleter` case turns on.
Regression tests go in next to the existing `..` ones: `test_prepare_path_rejects_absolute_path` for `compfs` and `monoiofs`, `test_confined_join_rejects_escaping_keys` for `fs`, plus an end-to-end `fs` test that drives `delete_iter` with an absolute path and asserts the outside file survives. The end-to-end test fails on the current tree.
# Are there any user-facing changes?
<!--
If there are user-facing changes then we may require documentation to be updated before approving the PR.
-->
An absolute key passed to `fs`, `compfs` or `monoiofs` now returns `ErrorKind::NotFound` instead of resolving outside the configured root. Paths that arrive through the normal `Operator` methods are unaffected, since `normalize_path` has already stripped the leading `/` by then. `"/"` still resolves to the root itself.
# AI Usage Statement
<!--
If you are using AI tools to build this PR, please include a statement specifying the tool and models you are using.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(services): reject absolute paths in confined_join and prepare_path [opendal]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo commented on PR #8005:
URL: https://github.com/apache/opendal/pull/8005#issuecomment-5615290810
Reopening to retrigger CI; the original workflow runs expired before they could be approved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(services): reject absolute paths in confined_join and prepare_path [opendal]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo closed pull request #8005: fix(services): reject absolute paths in confined_join and prepare_path
URL: https://github.com/apache/opendal/pull/8005
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(services): reject absolute paths in confined_join and prepare_path [opendal]
Posted by "aysha-afrah26 (via GitHub)" <gi...@apache.org>.
aysha-afrah26 commented on PR #8005:
URL: https://github.com/apache/opendal/pull/8005#issuecomment-5276850775
any update?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] fix(services): reject absolute paths in confined_join and prepare_path [opendal]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo merged PR #8005:
URL: https://github.com/apache/opendal/pull/8005
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org