Prepare release 2.14.2 (#890)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Author: 3 people

pydantic_settings/sources/providers/nested_secrets.py

@@ -1,7 +1,7 @@
 import os
 import warnings
+from collections.abc import Iterator
 from functools import reduce
-from glob import iglob
 from pathlib import Path
 from typing import TYPE_CHECKING, Any, Literal, Optional
 
@@ -146,17 +146,61 @@ def validate_secrets_path(self, path: Path) -> None:
         else:
             if not path.is_dir():
                 raise SettingsError(f'secrets_dir must reference a directory, not a {path_type_label(path)}')
-            secrets_dir_size = sum(f.stat().st_size for f in path.glob('**/*') if f.is_file())
+            secrets_dir_size = sum(f.stat().st_size for f in self._iter_secret_files(path))
             if secrets_dir_size > self.secrets_dir_max_size:
                 raise SettingsError(f'secrets_dir size is above {self.secrets_dir_max_size} bytes')
 
     @staticmethod
-    def load_secrets(path: Path) -> dict[str, str]:
-        return {
-            str(p.relative_to(path)): p.read_text().strip()
-            for p in map(Path, iglob(f'{path}/**/*', recursive=True))
-            if p.is_file()
-        }
+    def _iter_secret_files(path: Path) -> Iterator[Path]:
+        """Yield the secret files contained in ``path``.
+
+        ``path`` is expected to already be resolved. The directory tree is walked
+        explicitly so that symbolic links are handled safely:
+
+        * a file is only yielded if its real location stays within ``path``; entries
+          that resolve outside of it (e.g. through a symbolic link) are skipped, so
+          they neither contribute to the ``secrets_dir_max_size`` accounting nor get
+          loaded;
+        * each real directory is visited at most once, so cyclic or repeated
+          symlinks cannot make the walk loop and inflate the size accounting or the
+          number of loaded secrets.
+
+        Because the size check and the loader share this iterator, they always see
+        the same set of files.
+        """
+        seen_dirs: set[Path] = set()
+
+        def walk(directory: Path) -> Iterator[Path]:
+            # Guard against symlink loops / a directory reachable through multiple
+            # links being traversed more than once.
+            resolved_dir = directory.resolve()
+            if resolved_dir in seen_dirs:
+                return
+            seen_dirs.add(resolved_dir)
+            try:
+                entries = sorted(directory.iterdir())
+            except OSError:
+                return
+            for entry in entries:
+                resolved = entry.resolve()
+                if resolved.is_dir():
+                    # Only descend into directories that stay within secrets_dir.
+                    # A symlinked directory pointing outside of ``path`` is not
+                    # followed at all, so we never walk (potentially large) external
+                    # trees and never read files from outside secrets_dir.
+                    if resolved == path or path in resolved.parents:
+                        yield from walk(entry)
+                elif resolved.is_file() and path in resolved.parents:
+                    # Defense in depth: a file whose real location escapes
+                    # secrets_dir (e.g. a symlink pointing outside of ``path``) is
+                    # skipped from both the size accounting and the load.
+                    yield entry
+
+        yield from walk(path)
+
+    @classmethod
+    def load_secrets(cls, path: Path) -> dict[str, str]:
+        return {str(p.relative_to(path)): p.read_text().strip() for p in cls._iter_secret_files(path)}
 
     def __repr__(self) -> str:
         return f'NestedSecretsSettingsSource(secrets_dir={self.secrets_dir!r})'

pydantic_settings/version.py

@@ -1 +1 @@
-VERSION = '2.14.1'
+VERSION = '2.14.2'

tests/test_source_nested_secrets.py

@@ -1,5 +1,7 @@
 from enum import Enum
 from os import sep
+from pathlib import Path
+from unittest.mock import patch
 
 import pytest
 from pydantic import BaseModel
@@ -195,6 +197,165 @@ class Settings(AppSettings):
     }
 
 
+def test_symlink_dir_escaping_secrets_dir_is_ignored(env, tmp_path):
+    """Regression test for GHSA-4xgf-cpjx-pc3j.
+
+    A directory entry inside ``secrets_dir`` that is a symbolic link to a directory
+    *outside* of ``secrets_dir`` must not be followed: its files must not leak into
+    settings values.
+    """
+    env.set('DB__USER', 'user')
+
+    secrets_dir = tmp_path / 'secrets'
+    secrets_dir.mkdir()
+    outside = tmp_path / 'outside'
+    outside.mkdir()
+    outside.joinpath('passwd').write_text('leaked-secret')
+
+    # secrets/db -> ../outside (escapes secrets_dir)
+    secrets_dir.joinpath('db').symlink_to(outside)
+
+    class Settings(AppSettings):
+        model_config = SettingsConfigDict(
+            secrets_dir=secrets_dir,
+            env_nested_delimiter='__',
+            secrets_nested_subdir=True,
+        )
+
+    # the out-of-tree file is not read; passwd keeps its default
+    assert Settings().model_dump() == {
+        'app_key': None,
+        'db': {'user': 'user', 'passwd': None},
+    }
+
+
+def test_symlink_file_escaping_secrets_dir_is_ignored(env, tmp_path):
+    """Regression test for GHSA-4xgf-cpjx-pc3j (file-level symlink variant)."""
+    env.set('DB__USER', 'user')
+
+    secrets_dir = tmp_path / 'secrets'
+    (secrets_dir / 'db').mkdir(parents=True)
+    outside = tmp_path / 'outside'
+    outside.mkdir()
+    outside.joinpath('passwd').write_text('leaked-secret')
+
+    # secrets/db/passwd -> ../../outside/passwd (escapes secrets_dir)
+    secrets_dir.joinpath('db', 'passwd').symlink_to(outside / 'passwd')
+
+    class Settings(AppSettings):
+        model_config = SettingsConfigDict(
+            secrets_dir=secrets_dir,
+            env_nested_delimiter='__',
+            secrets_nested_subdir=True,
+        )
+
+    assert Settings().model_dump() == {
+        'app_key': None,
+        'db': {'user': 'user', 'passwd': None},
+    }
+
+
+def test_symlink_escape_does_not_bypass_max_size(env, tmp_path):
+    """Regression test for GHSA-4xgf-cpjx-pc3j (size-limit bypass).
+
+    The ``secrets_dir_max_size`` accounting must see the same files as the loader.
+    An out-of-tree file reached through a symlink previously counted as 0 bytes in
+    the size check (``Path.glob``) while still being read by the loader
+    (``glob.iglob(recursive=True)``). After the fix it is excluded from both, so the
+    large out-of-tree file neither trips the size cap nor leaks into settings.
+    """
+    env.set('DB__USER', 'user')
+
+    secrets_dir = tmp_path / 'secrets'
+    secrets_dir.mkdir()
+    outside = tmp_path / 'outside'
+    outside.mkdir()
+    # 512 bytes, well above the 100 byte cap below
+    outside.joinpath('passwd').write_text('S' * 512)
+    secrets_dir.joinpath('db').symlink_to(outside)
+
+    class Settings(AppSettings):
+        model_config = SettingsConfigDict(
+            secrets_dir=secrets_dir,
+            env_nested_delimiter='__',
+            secrets_nested_subdir=True,
+            secrets_dir_max_size=100,
+        )
+
+    # No SettingsError, and the out-of-tree payload is not loaded.
+    assert Settings().model_dump() == {
+        'app_key': None,
+        'db': {'user': 'user', 'passwd': None},
+    }
+
+
+def test_cyclic_symlink_does_not_inflate_size(env, tmp_path):
+    """Regression test for GHSA-4xgf-cpjx-pc3j (resource-consumption / CWE-400).
+
+    A cyclic (or repeated) symlink inside ``secrets_dir`` must not cause the
+    directory walk to loop. Otherwise a single small file gets visited many times,
+    inflating the ``secrets_dir_max_size`` accounting (and the number of loaded
+    secrets). Each real directory must be traversed at most once.
+    """
+    env.set('DB__USER', 'user')
+
+    secrets_dir = tmp_path / 'secrets'
+    (secrets_dir / 'db').mkdir(parents=True)
+    secrets_dir.joinpath('db', 'passwd').write_text('secret2')
+    # secrets/db/loop -> secrets (cycle): a naive recursive glob would revisit
+    # passwd dozens of times.
+    secrets_dir.joinpath('db', 'loop').symlink_to(secrets_dir)
+
+    class Settings(AppSettings):
+        model_config = SettingsConfigDict(
+            secrets_dir=secrets_dir,
+            env_nested_delimiter='__',
+            secrets_nested_subdir=True,
+            # passwd is 7 bytes; with the cycle un-guarded the walk would count it
+            # many times and exceed this cap.
+            secrets_dir_max_size=50,
+        )
+
+    # The walk terminates, counts passwd once, and loads it exactly once.
+    assert Settings().model_dump() == {
+        'app_key': None,
+        'db': {'user': 'user', 'passwd': 'secret2'},
+    }
+
+
+def test_symlinked_dir_escaping_secrets_dir_is_not_walked(tmp_path):
+    """A symlinked directory pointing outside ``secrets_dir`` must not be traversed.
+
+    Even though out-of-tree files are filtered out, descending into the external
+    tree wastes I/O and contradicts the intent of not following symlinks outside
+    ``secrets_dir`` (potential DoS via a large external tree). The walk must not
+    ``iterdir`` anything outside of ``secrets_dir``.
+    """
+    secrets_dir = tmp_path / 'secrets'
+    secrets_dir.mkdir()
+    secrets_dir.joinpath('legit').write_text('ok')
+
+    external = tmp_path / 'external'
+    (external / 'deep').mkdir(parents=True)
+    external.joinpath('deep', 'passwd').write_text('leaked')
+    secrets_dir.joinpath('link').symlink_to(external)
+
+    resolved_secrets = secrets_dir.resolve()
+    walked: list[Path] = []
+    original_iterdir = Path.iterdir
+
+    def tracking_iterdir(self):
+        walked.append(self.resolve())
+        return original_iterdir(self)
+
+    with patch.object(Path, 'iterdir', tracking_iterdir):
+        files = list(NestedSecretsSettingsSource._iter_secret_files(resolved_secrets))
+
+    # only the in-tree file is yielded, and nothing outside secrets_dir is walked
+    assert [f.name for f in files] == ['legit']
+    assert all(d == resolved_secrets or resolved_secrets in d.parents for d in walked), walked
+
+
 @pytest.mark.parametrize(
     'conf,secrets,dirs,expected',
     (