fix: validate filepath in request

internal/server/async_rest.go

@@ -23,6 +23,7 @@
 	"github.com/gorilla/mux"
 
 	"github.com/lf-edge/ekuiper/v2/internal/pkg/async"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 const (
@@ -44,6 +45,10 @@
 		handleError(w, err, "Invalid body: Error decoding json", logger)
 		return
 	}
+	if err := validate.ValidatePath(rsi.FilePath); err != nil {
+		handleError(w, err, "Invalid file path", logger)
+		return
+	}
 	taskID, err := handleDataImportAsyncTask(rsi, partial, stop)
 	if err != nil {
 		handleError(w, err, "", logger)

internal/server/import_export.go

@@ -33,6 +33,7 @@
 	"github.com/lf-edge/ekuiper/v2/pkg/ast"
 	"github.com/lf-edge/ekuiper/v2/pkg/cast"
 	"github.com/lf-edge/ekuiper/v2/pkg/infra"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 type ConfManager interface {
@@ -401,6 +402,11 @@
 		handleError(w, err, "Invalid body: Error decoding json", logger)
 		return
 	}
+	if err := validate.ValidatePath(rsi.FilePath); err != nil {
+		handleError(w, err, "", logger)
+		return
+	}
+
 	result, err := handleConfigurationImport(context.Background(), rsi, partial, stop)
 	if err != nil {
 		if result != nil && err.Error() == ProcessErr {

internal/server/plugin_init.go

@@ -33,6 +33,7 @@
 	"github.com/lf-edge/ekuiper/v2/internal/plugin"
 	"github.com/lf-edge/ekuiper/v2/internal/plugin/native"
 	"github.com/lf-edge/ekuiper/v2/pkg/errorx"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 var nativeManager *native.Manager
@@ -85,6 +86,11 @@
 			handleError(w, err, fmt.Sprintf("Invalid body: Error decoding the %s plugin json", plugin.PluginTypes[t]), logger)
 			return
 		}
+		if err := validate.ValidatePath(sd.GetFile()); err != nil {
+			handleError(w, err, "", logger)
+			return
+		}
+
 		err = nativeManager.Register(t, sd)
 		if err != nil {
 			handleError(w, err, fmt.Sprintf("%s plugins create command error", plugin.PluginTypes[t]), logger)

internal/server/rest.go

@@ -49,6 +49,7 @@
 	"github.com/lf-edge/ekuiper/v2/pkg/kv"
 	"github.com/lf-edge/ekuiper/v2/pkg/memory"
 	"github.com/lf-edge/ekuiper/v2/pkg/tracer"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 const (
@@ -340,7 +341,10 @@
 				handleError(w, err, "Invalid body: missing necessary field", logger)
 				return
 			}
-
+			if err := validate.ValidatePath(fc.FilePath); err != nil {
+				handleError(w, err, "", logger)
+				return
+			}
 			filePath := filepath.Join(uploadDir, fc.Name)
 			err = upload(fc)
 			if err != nil {
@@ -404,6 +408,11 @@
 	vars := mux.Vars(r)
 	name := vars["name"]
 	filePath := filepath.Join(uploadDir, name)
+	if err := validate.ValidatePath(filePath); err != nil {
+		handleError(w, err, "", logger)
+		return
+	}
+
 	e := os.Remove(filePath)
 	if e != nil {
 		handleError(w, e, "Error deleting the file", logger)

internal/server/schema_init.go

@@ -27,6 +27,7 @@
 	"github.com/lf-edge/ekuiper/v2/internal/pkg/def"
 	"github.com/lf-edge/ekuiper/v2/internal/schema"
 	"github.com/lf-edge/ekuiper/v2/pkg/errorx"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 func init() {
@@ -70,6 +71,10 @@
 			handleError(w, err, "Invalid body: Error decoding schema json", logger)
 			return
 		}
+		if err := validate.ValidatePath(sch.FilePath); err != nil {
+			handleError(w, err, "", logger)
+			return
+		}
 		if err = sch.Validate(); err != nil {
 			handleError(w, nil, "Invalid body", logger)
 			return

internal/server/service_init.go

@@ -27,6 +27,7 @@
 	"github.com/lf-edge/ekuiper/v2/internal/binder"
 	"github.com/lf-edge/ekuiper/v2/internal/service"
 	"github.com/lf-edge/ekuiper/v2/pkg/errorx"
+	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
 var serviceManager *service.Manager
@@ -75,6 +76,10 @@
 			handleError(w, err, "Invalid body: Error decoding the %s service request payload", logger)
 			return
 		}
+		if err := validate.ValidatePath(sd.File); err != nil {
+			handleError(w, err, "", logger)
+			return
+		}
 		err = serviceManager.Create(sd)
 		if err != nil {
 			handleError(w, err, "service create command error", logger)

pkg/validate/validate.go

@@ -34,3 +34,10 @@ func ValidateID(id string) error {
 	}
 	return nil
 }
+
+func ValidatePath(path string) error {
+	if strings.Contains(path, "..") {
+		return fmt.Errorf("path: %s should not contain ..", path)
+	}
+	return nil
+}

pkg/validate/validate_test.go

@@ -49,3 +49,8 @@ func TestValidateRuleID(t *testing.T) {
 		require.Equal(t, tc.err, ValidateID(tc.id))
 	}
 }
+
+func TestValidatePath(t *testing.T) {
+	require.Error(t, ValidatePath("../a"))
+	require.NoError(t, ValidatePath("./a"))
+}