fix(provisioner): skip symlinks in CopyTemplateToContainer Walk (OFFSEC-010)

filepath.Walk follows symlinks by default. A malicious org template containing a symlink (e.g. template/.ssh → /root/.ssh) could escape the intended directory and include arbitrary host files in the tar archive copied into workspace containers. Fix: skip symlinks in the Walk callback. Broken template symlinks are a silent no-op rather than an error, matching the security- first posture (no escalation on unexpected input). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-14 18:26:47 +00:00
parent 146009af51
commit 1a4d012383
1 changed files with 9 additions and 0 deletions
@@ -795,6 +795,15 @@ func (p *Provisioner) CopyTemplateToContainer(ctx context.Context, containerID,
 		if err != nil {
 			return err
 		}
+		// OFFSEC-010: skip symlinks to prevent path traversal via malicious
+		// template symlinks (e.g. template/.ssh → /root/.ssh). filepath.Walk
+		// follows symlinks by default, so without this guard a crafted symlink
+		// inside the template directory could escape to include arbitrary host
+		// files in the tar archive. We intentionally skip rather than error so
+		// a broken symlink in an org template is a silent no-op.
+		if info.Mode()&os.ModeSymlink != 0 {
+			return nil
+		}
 		rel, err := filepath.Rel(templatePath, path)
 		if err != nil {
 			return err