From 86cbbaf6c17dbcf62bb5ea24cb46d1c922284080 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 22 Apr 2025 18:19:03 +0000 Subject: [PATCH] apply security patch: release-10.4.18/369-202504020741.patch commit c0f0d89a6b403c209b189704873b9d3502a81234 Author: Andres Martinez Gotor Date: Mon Mar 31 12:15:52 2025 +0200 Sanitize paths before evaluating access to route --- pkg/api/pluginproxy/ds_proxy.go | 10 +++++++++- pkg/api/pluginproxy/ds_proxy_test.go | 8 ++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/pkg/api/pluginproxy/ds_proxy.go b/pkg/api/pluginproxy/ds_proxy.go index 8037c79a123..c4159d9c26e 100644 --- a/pkg/api/pluginproxy/ds_proxy.go +++ b/pkg/api/pluginproxy/ds_proxy.go @@ -300,7 +300,15 @@ func (proxy *DataSourceProxy) validateRequest() error { } // route match - if !strings.HasPrefix(proxy.proxyPath, route.Path) { + r1, err := util.CleanRelativePath(proxy.proxyPath) + if err != nil { + return err + } + r2, err := util.CleanRelativePath(route.Path) + if err != nil { + return err + } + if !strings.HasPrefix(r1, r2) { continue } diff --git a/pkg/api/pluginproxy/ds_proxy_test.go b/pkg/api/pluginproxy/ds_proxy_test.go index 13e6ed00735..bf730484c11 100644 --- a/pkg/api/pluginproxy/ds_proxy_test.go +++ b/pkg/api/pluginproxy/ds_proxy_test.go @@ -230,6 +230,14 @@ func TestDataSourceProxy_routeRule(t *testing.T) { err = proxy.validateRequest() require.NoError(t, err) }) + + t.Run("path with slashes and user is editor", func(t *testing.T) { + ctx, _ := setUp() + proxy, err := setupDSProxyTest(t, ctx, ds, routes, "//api//admin") + require.NoError(t, err) + err = proxy.validateRequest() + require.Error(t, err) + }) }) })