Runtime cache does not enforce Project directory permissions and ownership

Aperta
  • Qualcosa non va?
#114 0 commenti 0 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@pheus ci sta già lavorando.

Dal 6/11/2026.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
52/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
django, python
Ambito
backend, security

Direzione di ricerca

Start by reading netbox_scripts/runtime/cache.py, especially _ensure_private_root() and materialize_revision(), then inspect the storage code used by store.write_revision(). Reproduce the reported umask and permissive-directory cases and check the Project, staging, and lock file modes and ownership. Done means new directories and lock files have private permissions, unsafe existing Project directories are rejected, and a verified published revision cannot be replaced.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

app: scripts Bucket: KTLO severity: medium status: accepted type: bug
Plugin Version

v0.0.1

NetBox Version

v4.7.1

Python Version

3.12

Steps to Reproduce

Using one account in NetBox's Django shell (python manage.py shell):

  1. Prepare a valid revision containing example.py and write it to an InMemoryStorage using netbox_scripts.storage.store.write_revision().
  2. Create a temporary cache root and set its permissions to 0755 with chmod().
  3. Set the process umask to 0002 and call netbox_scripts.runtime.cache.materialize_revision() with that root. Restore the previous umask in a finally block.
  4. Inspect <root>/<storage_key>/ and its .<digest>.lock file.
  5. Create a second cache root with permissions 01777. Inside it, create <storage_key>/ and set its permissions to 0777.
  6. Materialize the same revision using the second root.
Expected Behavior

New Project and staging directories are created with private permissions.

Before using an existing Project directory, the plugin checks that it belongs to the NetBox account or root and rejects permissions that let other accounts modify its contents.

The published revision remains protected from replacement after verification.

Observed Behavior

In the first case, the Project directory is created with permissions 0775 and the lock file with 0664. Project and staging directory creation follows the process umask.

In the second case, materialization succeeds inside the existing 0777 Project directory.

Source inspection shows that _ensure_private_root() checks the cache root and its ancestors, but the Project directory is accepted through mkdir(exist_ok=True) without checking its owner or permissions.

When another local account can traverse the cache path, writable Project directories allow it to replace the published revision directory despite the revision's read-only permissions.

The default cache root, when created by the plugin with permissions 0700, prevents other accounts from reaching these directories. The exposure requires a cache location that other accounts can traverse.

Lingua principale
Python
Stelle
8
Fork
0
Merge medio
11h 22m
PR unite (30g)
40

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di netbox-community/netbox-scripts

Tutte le issue di netbox-community/netbox-scripts

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.