feat: warn when file accessors resolve outside their search paths - #1566
Open
Moep90 wants to merge 3 commits into
Open
feat: warn when file accessors resolve outside their search paths#1566Moep90 wants to merge 3 commits into
Moep90 wants to merge 3 commits into
Conversation
Jsonnet's import and file_read natives, the jinja2 render callback, the yaml and directory natives, and input glob expansion all resolve a caller-supplied name against search paths with os.path.join. A name containing ".." or a symlink can resolve outside the inventory and read an unrelated file such as an SSH key, and nothing flagged it. Add warn_on_path_traversal in utils: it compares the resolved realpath against the allowed roots and logs a warning when the path escapes all of them. Wire it into the resource native callbacks and the input path loop. The check is warn-only, so the read still succeeds and no existing setup breaks; the escape is now visible in the logs.
Add --path-traversal-mode, also settable in the .kapitan compile section, so a resolved path escaping its search paths can warn (default), fail the compile, or be ignored. check_path_traversal now honours the mode; workers re-apply it in compile_target so it survives the spawn start method. Memoise realpath of the roots since they repeat across a compile. Document the option on the compile command reference, and cover the error, off and invalid modes plus the search_imports multi-root wiring in tests.
MagicMock args returned a Mock for path_traversal_mode, which failed validation in set_path_traversal_mode (expected warn/error/off). Set it explicitly so the worker re-apply step gets a real value.
Moep90
force-pushed
the
harden/path-traversal-warning
branch
from
June 19, 2026 18:57
edf9bfa to
705c650
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Log a warning when a file accessor resolves a path outside its search paths,
for example through a
..segment or a symlink. The warning is informationalonly; nothing is blocked.
Why
Several accessors resolve a caller-supplied name against search paths with
os.path.joinand then open whatever that produces:importresolution (search_imports)file_read,yaml_load,yaml_load_stream,file_exists,dir_files_listanddir_files_readjsonnet nativesjinja2_render_filecallbackA name like
../../../../home/user/.ssh/id_rsaresolves cleanly and the file isread, with nothing recording that the access left the inventory. This is the
first, non-breaking step toward confining those reads: make the escape visible
before any release starts rejecting it.
Approach
warn_on_path_traversal(roots, resolved_path, accessor)inutils.py. Itcompares
os.path.realpath(resolved_path)against the realpath of eachallowed root and logs a warning only when the path is contained in none of
them.
realpathmeans symlink escapes are caught too, not just...path) and into
search_imports(checked against cwd, the kapitan installpath, and the search paths).
base.py, checked against all search paths.Verification
tests/test_path_traversal_warning.py(5 tests): warns on escape, silentin-tree, silent when contained in any of several roots, and confirms
read_filestill returns the content while logging the escape (warn-only).tests/test_jsonnet.py,tests/test_inputs_base.py,tests/test_input_compile_obj.pypass unchanged.warnings on legitimate compiles.
Note
Warn-only by design. A follow-up can add an enforce mode once the warning has
been out long enough to surface any legitimate out-of-tree access.