|
| 1 | +From 16e3f5f89b13152057ae9a90f95c3128f3164e04 Mon Sep 17 00:00:00 2001 |
| 2 | +From: George Jenkins <gvjenkins@gmail.com> |
| 3 | +Date: Fri, 6 Mar 2026 08:01:01 -0800 |
| 4 | +Subject: [PATCH] fix: Chart dot-name path bug |
| 5 | + |
| 6 | +Signed-off-by: George Jenkins <gvjenkins@gmail.com> |
| 7 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 8 | +Upstream-reference: https://github.com/helm/helm/commit/8fb76d6ab555577e98e23b7500009537a471feee.patch |
| 9 | +--- |
| 10 | + pkg/chart/metadata.go | 3 +++ |
| 11 | + pkg/chartutil/expand.go | 18 ++++++++++++++++++ |
| 12 | + 2 files changed, 21 insertions(+) |
| 13 | + |
| 14 | +diff --git a/pkg/chart/metadata.go b/pkg/chart/metadata.go |
| 15 | +index a08a97c..0e78fda 100644 |
| 16 | +--- a/pkg/chart/metadata.go |
| 17 | ++++ b/pkg/chart/metadata.go |
| 18 | +@@ -112,6 +112,9 @@ func (md *Metadata) Validate() error { |
| 19 | + return ValidationError("chart.metadata.name is required") |
| 20 | + } |
| 21 | + |
| 22 | ++ if md.Name == "." || md.Name == ".." { |
| 23 | ++ return ValidationErrorf("chart.metadata.name %q is not allowed", md.Name) |
| 24 | ++ } |
| 25 | + if md.Name != filepath.Base(md.Name) { |
| 26 | + return ValidationErrorf("chart.metadata.name %q is invalid", md.Name) |
| 27 | + } |
| 28 | +diff --git a/pkg/chartutil/expand.go b/pkg/chartutil/expand.go |
| 29 | +index 7ae1ae6..af1dfa3 100644 |
| 30 | +--- a/pkg/chartutil/expand.go |
| 31 | ++++ b/pkg/chartutil/expand.go |
| 32 | +@@ -17,6 +17,7 @@ limitations under the License. |
| 33 | + package chartutil |
| 34 | + |
| 35 | + import ( |
| 36 | ++ "fmt" |
| 37 | + "io" |
| 38 | + "os" |
| 39 | + "path/filepath" |
| 40 | +@@ -51,12 +52,29 @@ func Expand(dir string, r io.Reader) error { |
| 41 | + return errors.New("chart name not specified") |
| 42 | + } |
| 43 | + |
| 44 | ++ // Reject chart names that are POSIX path dot-segments or dot-dot segments or contain path separators. |
| 45 | ++ // A dot-segment name (e.g. ".") causes SecureJoin to resolve to the root |
| 46 | ++ // directory and extraction then to write files directly into that extraction root |
| 47 | ++ // instead of a per-chart subdirectory. |
| 48 | ++ if chartName == "." || chartName == ".." { |
| 49 | ++ return fmt.Errorf("chart name %q is not allowed", chartName) |
| 50 | ++ } |
| 51 | ++ if chartName != filepath.Base(chartName) { |
| 52 | ++ return fmt.Errorf("chart name %q must not contain path separators", chartName) |
| 53 | ++ } |
| 54 | ++ |
| 55 | + // Find the base directory |
| 56 | + chartdir, err := securejoin.SecureJoin(dir, chartName) |
| 57 | + if err != nil { |
| 58 | + return err |
| 59 | + } |
| 60 | + |
| 61 | ++ // Defense-in-depth: the chart directory must be a subdirectory of dir, |
| 62 | ++ // never dir itself. |
| 63 | ++ if chartdir == dir { |
| 64 | ++ return fmt.Errorf("chart name %q resolves to the extraction root", chartName) |
| 65 | ++ } |
| 66 | ++ |
| 67 | + // Copy all files verbatim. We don't parse these files because parsing can remove |
| 68 | + // comments. |
| 69 | + for _, file := range files { |
| 70 | +-- |
| 71 | +2.45.4 |
| 72 | + |
0 commit comments