lukaszraczylo/gohoarder
1
0
Fork 0
mirror of https://github.com/lukaszraczylo/gohoarder.git synced 2026-10-12 00:45:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 in the go_modules group across 1 directory (#36)

Browse Source 
* chore(deps): bump google.golang.org/grpc

Bumps the go_modules group with 1 update in the / directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.78.0 to 1.79.3
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.79.3
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <[email protected]>

* Resolve merge conflicts and harden storage paths

Co-authored-by: lukaszraczylo <[email protected]>

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <[email protected]>
Co-authored-by: lukaszraczylo <[email protected]>
This commit is contained in:
dependabot[bot]
2026-09-03 11:16:29 +01:00
committed by GitHub
co-authored by dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> copilot-swe-agent[bot] <198982749+[email protected]> lukaszraczylo
parent 7fb596aafd
commit edeb2eca0c
4 changed files with 85 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/storage/filesystem/filesystem.go
+54 -21
View File
@@ -91,17 +91,30 @@ func (fs *FilesystemStorage) Put(ctx context.Context, key string, data io.Reader
metrics.RecordStorageOperation("filesystem", "put", "error")
return err
}
dir := filepath.Dir(path)
relPath, err := fs.relativeToBase(path)
if err != nil {
metrics.RecordStorageOperation("filesystem", "put", "error")
return err
}
dir := filepath.Dir(relPath)
root, err := os.OpenRoot(fs.basePath)
if err != nil {
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to open storage root")
}
defer root.Close() // #nosec G307 -- Best-effort cleanup of opened storage root
// Create directory
if mkErr := os.MkdirAll(dir, 0750); mkErr != nil {
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(mkErr, errors.ErrCodeStorageFailure, "failed to create directory")
if dir != "." {
if mkErr := root.MkdirAll(dir, 0750); mkErr != nil {
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(mkErr, errors.ErrCodeStorageFailure, "failed to create directory")
}
}
// Create temp file for atomic write
tempPath := path + ".tmp"
tempFile, err := os.Create(tempPath) // #nosec G304 -- Temp path is constructed from sanitized storage key
tempPath := relPath + ".tmp"
tempFile, err := root.Create(tempPath)
if err != nil {
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to create temp file")
@@ -115,14 +128,14 @@ func (fs *FilesystemStorage) Put(ctx context.Context, key string, data io.Reader
written, err := io.Copy(multiWriter, data)
if err != nil {
_ = tempFile.Close() // #nosec G104 -- Cleanup, error not critical
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = tempFile.Close() // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to write data")
}
if err := tempFile.Close(); err != nil {
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to close temp file")
}
@@ -133,13 +146,13 @@ func (fs *FilesystemStorage) Put(ctx context.Context, key string, data io.Reader
sha256Sum := hex.EncodeToString(sha256Hash.Sum(nil))
if opts.ChecksumMD5 != "" && opts.ChecksumMD5 != md5Sum {
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "checksum_error")
return errors.New(errors.ErrCodeChecksumMismatch, "MD5 checksum mismatch")
}
if opts.ChecksumSHA256 != "" && opts.ChecksumSHA256 != sha256Sum {
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "checksum_error")
return errors.New(errors.ErrCodeChecksumMismatch, "SHA256 checksum mismatch")
}
@@ -151,13 +164,13 @@ func (fs *FilesystemStorage) Put(ctx context.Context, key string, data io.Reader
fs.mu.Lock()
if fs.quota > 0 && fs.used+written > fs.quota {
fs.mu.Unlock()
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "quota_exceeded")
return errors.QuotaExceeded(fs.quota)
}
if err := os.Rename(tempPath, path); err != nil {
if err := root.Rename(tempPath, relPath); err != nil {
fs.mu.Unlock()
_ = os.Remove(tempPath) // #nosec G104 -- Cleanup, error not critical
_ = root.Remove(tempPath)
metrics.RecordStorageOperation("filesystem", "put", "error")
return errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to rename temp file")
}
@@ -408,22 +421,42 @@ func (fs *FilesystemStorage) keyToPath(key string) (string, error) {
}
target := filepath.Join(fs.basePath, cleaned)
// Defense-in-depth: verify the resolved absolute path is contained
// within the base directory.
targetAbs, err := filepath.Abs(target)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to resolve path")
}
if err := fs.ensureWithinBase(targetAbs); err != nil {
return "", errors.New(errors.ErrCodeStorageFailure, fmt.Sprintf("path traversal rejected: %s", key))
}
return targetAbs, nil
}
func (fs *FilesystemStorage) ensureWithinBase(path string) error {
rel, err := fs.relativeToBase(path)
if err != nil {
return err
}
if rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
return errors.New(errors.ErrCodeStorageFailure, fmt.Sprintf("path traversal rejected: %s", path))
}
return nil
}
func (fs *FilesystemStorage) relativeToBase(path string) (string, error) {
baseAbs, err := filepath.Abs(fs.basePath)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to resolve base path")
}
if targetAbs != baseAbs && !strings.HasPrefix(targetAbs, baseAbs+string(os.PathSeparator)) {
return "", errors.New(errors.ErrCodeStorageFailure, fmt.Sprintf("path traversal rejected: %s", key))
pathAbs, err := filepath.Abs(path)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to resolve path")
}
return target, nil
rel, err := filepath.Rel(baseAbs, pathAbs)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "failed to compare path")
}
return rel, nil
}
// calculateUsage calculates current storage usage
pkg/storage/nfs/nfs.go
+28 -1
View File
@@ -130,7 +130,18 @@ func (s *Storage) Put(ctx context.Context, key string, data io.Reader, opts *sto
s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put path lookup failed; skipping fsync")
return nil
}
f, err := os.OpenFile(path, os.O_RDWR, 0) // #nosec G304 -- path resolved by sanitizing backend
relPath, err := relativeToBase(s.path, path)
if err != nil {
s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put path escaped configured base; skipping fsync")
return nil
}
root, err := os.OpenRoot(s.path)
if err != nil {
s.logger.Warn().Err(err).Str("path", s.path).Msg("nfs: failed to open configured base; skipping fsync")
return nil
}
defer root.Close() // #nosec G307 -- Best-effort cleanup of opened NFS root
f, err := root.OpenFile(relPath, os.O_RDWR, 0)
if err != nil {
s.logger.Warn().Err(err).Str("key", key).Msg("nfs: post-put open failed; skipping fsync")
return nil
@@ -226,6 +237,22 @@ func (s *Storage) GetLocalPath(ctx context.Context, key string) (string, error)
return s.fs.GetLocalPath(ctx, key)
}
func relativeToBase(basePath, path string) (string, error) {
baseAbs, err := filepath.Abs(basePath)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to resolve base path")
}
pathAbs, err := filepath.Abs(path)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to resolve path")
}
rel, err := filepath.Rel(baseAbs, pathAbs)
if err != nil {
return "", errors.Wrap(err, errors.ErrCodeStorageFailure, "nfs: failed to compare path")
}
return rel, nil
}
// detectMountType returns the filesystem type backing path. Linux-only: on
// other platforms the second return value is false. Implementation walks
// /proc/mounts and selects the longest matching mount point, which is the