Router allows exec paths hidden behind dot segments (/./exec, /x/../exec)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 新手友好度
- 56/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- docker, go, rust, typescript
调研方向
Read the router implementations and the existing empty segment checks in Go, Rust, and TypeScript, then inspect the spec flags and properties named in the issue. Add the dot segment cases to each router table and mirror the ALLOW_EMPTY_INTERIOR and emptySegmentsHideNoExec coverage. Done means dot segments are denied for every method in all three implementations, with the requested curl --path-as-is integration check passing.
由索引模型根据 Issue 内容生成。
描述
Describe the bug
The router allows exec paths hidden behind dot segments. GET /./exec/<id>/json and GET /x/../exec/<id>/json have a first segment of . or x, so the exec check (#49) does not match and the GET passthrough forwards them. This is the same class as the //exec/... bypass fixed for #55 (empty path segment not allowed), which only covers empty segments.
Found in the review of the #55 Task 3 PR. Router-level probe on that branch (Route("GET", path)):
| Path | Go | TS | Rust |
|---|---|---|---|
/./exec/abc/json |
Allow | Allow | Allow (by code reading, not probed) |
/x/../exec/abc/json |
Allow | Allow | Allow (by code reading, not probed) |
/containers/./mycontainer/exec |
Deny (exec) | Deny (exec) | Deny (exec) |
Impact: as with // before #55, a live daemon is expected to answer dot-segment paths with a 301 to the clean path, so nothing should leak. A client that follows the redirect re-enters the proxy on the clean path and is denied. But the router allows an exec path, which the spec's intent forbids, and it depends on daemon behaviour the proxy does not control.
Affected implementation(s)
- All
To Reproduce
- Any policy.
curl --path-as-is --unix-socket proxy.sock 'http://localhost/./exec/<id>/json'- The proxy forwards it (the daemon's answer, not a proxy 403).
Expected behavior
Deny any path with a . or .. segment for every method, right after the empty-segment check, e.g. dot path segment not allowed. Same check in Go, Rust and TS; a spec flag and property mirroring ALLOW_EMPTY_INTERIOR / emptySegmentsHideNoExec (exec path after dot-segment removal ⇒ denied); table rows in all three; an integration check with curl --path-as-is.
Alternatives considered:
- Normalise the path (RFC 3986 remove_dot_segments) and route on the result. Rejected: the proxy would then forward a path different from the one it routed, or have to rewrite it; denying is simpler and the Docker CLI never sends dot segments.
- Rely on the daemon's 301. Rejected for the same reason as #55: the router should not allow an exec path at all.
Environment
- Docker 29.4.0 (OrbStack), branch
fix/empty-segment-head-55.
Additional context
README.md and spec/README.md on that branch say dot segments are not denied yet.
- 主要语言
- Rust
- 星标
- 2
- 派生
- 0
- 平均合并
- 12 小时 11 分钟
- 30 天内合并 PR
- 30
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
ChainSafe/docker-socket-policy 的其他 Issue
-
Type: Feature
难度 5/5 一周以上 新手友好度 12/100
ChainSafe/docker-socket-policy#96 ·
维护者通常 1 天内回复
-
Priority: P3 Type: Enhancement
难度 4/5 3-5 天 新手友好度 15/100
ChainSafe/docker-socket-policy#95 ·
维护者通常 1 天内回复
-
Type: Feature
难度 5/5 一周以上 新手友好度 25/100
ChainSafe/docker-socket-policy#65 ·
维护者通常 1 天内回复
-
Type: Enhancement
难度 5/5 一周以上 新手友好度 38/100
ChainSafe/docker-socket-policy#46 · 1 条评论 ·
维护者通常 1 天内回复
查看 ChainSafe/docker-socket-policy 的全部 Issue
相似的 Issue
-
agent:triaged bug bughunt pm:pipenv priority:p1
难度 2/5 1-3 小时 新手友好度 78/100
SocketDev/socket-patch#1608 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
adorsys/status-list-server#698 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 70/100
nannou-org/egui_graph#92 ·
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 半天 新手友好度 72/100
sujithputta02/Esapay#13 ·
-
Deduplicate normalized_f64_bits (hash_table.rs and bloom_filter.rs)可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
tursodatabase/turso#10002 ·
维护者通常 1 天内回复