Merge branch 'security-1-2-fix-toctou-race' into '1-2-stable'v1.2.21-2-stable

[1.2] Fix TOCTOU race condition when serving files

See merge request gitlab/gitlab-pages!6

5 files changed, 49 insertions, 8 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 771831a9..b9bb16dd 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,10 +1,5 @@
-image: golang:1.8
-
 .test: &test
   script:
-  - make setup
-  - make verify
-  - make cover
   - echo "Running all tests without daemonizing..."
   - make test
   - echo "Running just the acceptance tests daemonized (tmpdir)...."
@@ -14,9 +9,19 @@ image: golang:1.8
   artifacts:
     paths:
       - bin/gitlab-pages
+
+verify:
+  image: golang:1.11
+  script:
+    - make setup
+    - make verify
+    - make cover
+  artifacts:
+    paths:
       - coverage.html
 
 test:1.8:
+  image: golang:1.8
   <<: *test
 
 test:1.9:
@@ -26,3 +31,7 @@ test:1.9:
 test:1.10:
   image: golang:1.10
   <<: *test
+
+test:1.11:
+  image: golang:1.11
+  <<: *test
diff --git a/CHANGELOG b/CHANGELOG
index 96ca259a..0c08b1b3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,6 @@
+v 1.2.2
+- Fix TOCTOU race condition when serving files
+
 v 1.2.1
 -  Fix 404 for project with capital letters !114
 
diff --git a/VERSION b/VERSION
index 6085e946..23aa8390 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.1
+1.2.2
diff --git a/internal/domain/domain.go b/internal/domain/domain.go
index 261707cf..2c4f4e29 100644
--- a/internal/domain/domain.go
+++ b/internal/domain/domain.go
@@ -15,6 +15,8 @@ import (
 	"sync"
 	"time"
 
+	"golang.org/x/sys/unix"
+
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httperrors"
 	"gitlab.com/gitlab-org/gitlab-pages/internal/httputil"
 )
@@ -231,7 +233,7 @@ func (d *D) HasProject(r *http.Request) bool {
 func (d *D) serveFile(w http.ResponseWriter, r *http.Request, origPath string) error {
 	fullPath := handleGZip(w, r, origPath)
 
-	file, err := os.Open(fullPath)
+	file, err := openNoFollow(fullPath)
 	if err != nil {
 		return err
 	}
@@ -257,7 +259,7 @@ func (d *D) serveCustomFile(w http.ResponseWriter, r *http.Request, code int, or
 	fullPath := handleGZip(w, r, origPath)
 
 	// Open and serve content of file
-	file, err := os.Open(fullPath)
+	file, err := openNoFollow(fullPath)
 	if err != nil {
 		return err
 	}
@@ -455,3 +457,7 @@ func (d *D) ServeNotFoundHTTP(w http.ResponseWriter, r *http.Request) {
 func endsWithSlash(path string) bool {
 	return strings.HasSuffix(path, "/")
 }
+
+func openNoFollow(path string) (*os.File, error) {
+	return os.OpenFile(path, os.O_RDONLY|unix.O_NOFOLLOW, 0)
+}
diff --git a/internal/domain/domain_test.go b/internal/domain/domain_test.go
index de780197..3912cbe3 100644
--- a/internal/domain/domain_test.go
+++ b/internal/domain/domain_test.go
@@ -396,6 +396,29 @@ func TestCacheControlHeaders(t *testing.T) {
 	assert.WithinDuration(t, now.UTC().Add(10*time.Minute), expiresTime.UTC(), time.Minute)
 }
 
+func TestOpenNoFollow(t *testing.T) {
+	tmpfile, err := ioutil.TempFile("", "link-test")
+	require.NoError(t, err)
+	defer tmpfile.Close()
+
+	orig := tmpfile.Name()
+	softLink := orig + ".link"
+	defer os.Remove(orig)
+
+	source, err := openNoFollow(orig)
+	require.NoError(t, err)
+	require.NotNil(t, source)
+	defer source.Close()
+
+	err = os.Symlink(orig, softLink)
+	require.NoError(t, err)
+	defer os.Remove(softLink)
+
+	link, err := openNoFollow(softLink)
+	require.Error(t, err)
+	require.Nil(t, link)
+}
+
 var chdirSet = false
 
 func setUpTests() {