Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Router allows exec paths hidden behind dot segments (/./exec, /x/../exec)

Cerrado
  • ¿Algo no está bien?
#70 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
1-2 días
Aptitud para principiantes
56/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
docker, go, rust, typescript
Área
backend-api-design, security

Línea de trabajo

Read the router implementations and the existing empty segment checks in Go, Rust, and TypeScript, then inspect the spec flags and properties named in the issue. Add the dot segment cases to each router table and mirror the ALLOW_EMPTY_INTERIOR and emptySegmentsHideNoExec coverage. Done means dot segments are denied for every method in all three implementations, with the requested curl --path-as-is integration check passing.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Priority: P2 Type: Bug

Describe the bug
The router allows exec paths hidden behind dot segments. GET /./exec/<id>/json and GET /x/../exec/<id>/json have a first segment of . or x, so the exec check (#49) does not match and the GET passthrough forwards them. This is the same class as the //exec/... bypass fixed for #55 (empty path segment not allowed), which only covers empty segments.

Found in the review of the #55 Task 3 PR. Router-level probe on that branch (Route("GET", path)):

Path Go TS Rust
/./exec/abc/json Allow Allow Allow (by code reading, not probed)
/x/../exec/abc/json Allow Allow Allow (by code reading, not probed)
/containers/./mycontainer/exec Deny (exec) Deny (exec) Deny (exec)

Impact: as with // before #55, a live daemon is expected to answer dot-segment paths with a 301 to the clean path, so nothing should leak. A client that follows the redirect re-enters the proxy on the clean path and is denied. But the router allows an exec path, which the spec's intent forbids, and it depends on daemon behaviour the proxy does not control.

Affected implementation(s)

  • All

To Reproduce

  1. Any policy.
  2. curl --path-as-is --unix-socket proxy.sock 'http://localhost/./exec/<id>/json'
  3. The proxy forwards it (the daemon's answer, not a proxy 403).

Expected behavior
Deny any path with a . or .. segment for every method, right after the empty-segment check, e.g. dot path segment not allowed. Same check in Go, Rust and TS; a spec flag and property mirroring ALLOW_EMPTY_INTERIOR / emptySegmentsHideNoExec (exec path after dot-segment removal ⇒ denied); table rows in all three; an integration check with curl --path-as-is.

Alternatives considered:

  • Normalise the path (RFC 3986 remove_dot_segments) and route on the result. Rejected: the proxy would then forward a path different from the one it routed, or have to rewrite it; denying is simpler and the Docker CLI never sends dot segments.
  • Rely on the daemon's 301. Rejected for the same reason as #55: the router should not allow an exec path at all.

Environment

  • Docker 29.4.0 (OrbStack), branch fix/empty-segment-head-55.

Additional context
README.md and spec/README.md on that branch say dot segments are not denied yet.

Lenguaje dominante
Rust
Estrellas
2
Forks
0
Merge medio
13 h 22 min
PR fusionados (30 d)
27

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de ChainSafe/docker-socket-policy

Todos los issues de ChainSafe/docker-socket-policy

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.