Runtime cache does not enforce Project directory permissions and ownership

オープン
  • 何か問題がありますか？
#114 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@pheus がすでに取り組んでいます。

2026年11月6日 から。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
52/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
django, python
領域
backend, security

調査の方向性

Start by reading netbox_scripts/runtime/cache.py, especially _ensure_private_root() and materialize_revision(), then inspect the storage code used by store.write_revision(). Reproduce the reported umask and permissive-directory cases and check the Project, staging, and lock file modes and ownership. Done means new directories and lock files have private permissions, unsafe existing Project directories are rejected, and a verified published revision cannot be replaced.

索引モデルが issue の本文から書いたものです。

説明

app: scripts Bucket: KTLO severity: medium status: accepted type: bug
Plugin Version

v0.0.1

NetBox Version

v4.7.1

Python Version

3.12

Steps to Reproduce

Using one account in NetBox's Django shell (python manage.py shell):

  1. Prepare a valid revision containing example.py and write it to an InMemoryStorage using netbox_scripts.storage.store.write_revision().
  2. Create a temporary cache root and set its permissions to 0755 with chmod().
  3. Set the process umask to 0002 and call netbox_scripts.runtime.cache.materialize_revision() with that root. Restore the previous umask in a finally block.
  4. Inspect <root>/<storage_key>/ and its .<digest>.lock file.
  5. Create a second cache root with permissions 01777. Inside it, create <storage_key>/ and set its permissions to 0777.
  6. Materialize the same revision using the second root.
Expected Behavior

New Project and staging directories are created with private permissions.

Before using an existing Project directory, the plugin checks that it belongs to the NetBox account or root and rejects permissions that let other accounts modify its contents.

The published revision remains protected from replacement after verification.

Observed Behavior

In the first case, the Project directory is created with permissions 0775 and the lock file with 0664. Project and staging directory creation follows the process umask.

In the second case, materialization succeeds inside the existing 0777 Project directory.

Source inspection shows that _ensure_private_root() checks the cache root and its ancestors, but the Project directory is accepted through mkdir(exist_ok=True) without checking its owner or permissions.

When another local account can traverse the cache path, writable Project directories allow it to replace the published revision directory despite the revision's read-only permissions.

The default cache root, when created by the plugin with permissions 0700, prevents other accounts from reaching these directories. The exposure requires a cache location that other accounts can traverse.

主要言語
Python
スター
8
フォーク
0
平均マージ
11時間 22分
マージ済み PR（30日）
40

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

netbox-community/netbox-scripts のほかの issue

netbox-community/netbox-scripts の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。