fix(core): Enforce safe path validation user Input (#3911)

Signed-off-by: Jörmungandrk <github@zerodaysec.org>
Signed-off-by: Song Gao <disxiaofei@163.com>
Co-authored-by: Jörmungandrk <47859767+odaysec@users.noreply.github.com>

Author: Yisaer

internal/pkg/filex/zip.go

@@ -23,9 +23,15 @@ import (
 	"path/filepath"
 
 	"github.com/pingcap/failpoint"
+
+	"github.com/lf-edge/ekuiper/v2/pkg/path"
 )
 
 func UnzipTo(f *zip.File, folder, name string) (err error) {
+	// Validate name to avoid path traversal and directory escape
+	if err := path.VerifyFileName(name); err != nil {
+		return err
+	}
 	defer func() {
 		failpoint.Inject("UnzipToErr", func() {
 			err = errors.New("UnzipToErr")

internal/plugin/native/manager.go

@@ -824,6 +824,10 @@ func (rr *Manager) loadRuntime(t plugin2.PluginType, soName, soFilepath, symbolN
 
 // Return the lowercase version of so name. It may be upper case in path.
 func (rr *Manager) getSoFilePath(t plugin2.PluginType, name string, isSoName bool) (string, error) {
+	// Validate plugin name to prevent path traversal or absolute paths
+	if strings.Contains(name, "/") || strings.Contains(name, "\\") || strings.Contains(name, "..") || strings.HasPrefix(name, ".") || strings.HasPrefix(name, "-") {
+		return "", fmt.Errorf("invalid soFileName %v", name)
+	}
 	var (
 		v      string
 		soname string

internal/schema/registry.go

@@ -177,6 +177,9 @@ func CreateOrUpdateSchema(info *Info) error {
 	if strings.Contains(info.Name, "/") || strings.Contains(info.Name, "\\") || strings.Contains(info.Name, "..") {
 		return fmt.Errorf("schema name %s is invalid", info.Name)
 	}
+	if strings.Contains(info.Version, "/") || strings.Contains(info.Version, "\\") || strings.Contains(info.Version, "..") {
+		return fmt.Errorf("schema version %s is invalid", info.Version)
+	}
 	st, ok := modules.SchemaTypeDefs[info.Type]
 	if !ok {
 		return fmt.Errorf("schema type %s not found", info.Type)

internal/server/rest.go

@@ -53,6 +53,7 @@ import (
 	"github.com/lf-edge/ekuiper/v2/pkg/infra"
 	"github.com/lf-edge/ekuiper/v2/pkg/kv"
 	"github.com/lf-edge/ekuiper/v2/pkg/memory"
+	"github.com/lf-edge/ekuiper/v2/pkg/path"
 	"github.com/lf-edge/ekuiper/v2/pkg/tracer"
 	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
@@ -291,6 +292,10 @@ func (f *fileContent) Validate() error {
 	if f.Name == "" {
 		return fmt.Errorf("invalid body: name is required")
 	}
+	// Disallow path traversal and path separators in name
+	if err := path.VerifyFileName(f.Name); err != nil {
+		return err
+	}
 	return nil
 }
 

internal/server/rule_manager.go

@@ -36,6 +36,7 @@ import (
 	"github.com/lf-edge/ekuiper/v2/pkg/ast"
 	"github.com/lf-edge/ekuiper/v2/pkg/errorx"
 	"github.com/lf-edge/ekuiper/v2/pkg/infra"
+	"github.com/lf-edge/ekuiper/v2/pkg/path"
 	"github.com/lf-edge/ekuiper/v2/pkg/replace"
 )
 
@@ -558,6 +559,10 @@ func deleteRuleMetrics(name string) {
 }
 
 func deleteRuleData(name string) {
+	if !path.IsSafeFileComponent(name) {
+		conf.Log.Errorf("delete rule data aborted: unsafe rule name '%s'", name)
+		return
+	}
 	dataLoc, err := conf.GetDataLoc()
 	if err != nil {
 		conf.Log.Errorf("delete rule data error: %v", err)

internal/service/manager.go

@@ -35,6 +35,7 @@ import (
 	"github.com/lf-edge/ekuiper/v2/internal/plugin"
 	"github.com/lf-edge/ekuiper/v2/pkg/cast"
 	"github.com/lf-edge/ekuiper/v2/pkg/kv"
+	pathutil "github.com/lf-edge/ekuiper/v2/pkg/path"
 	"github.com/lf-edge/ekuiper/v2/pkg/validate"
 )
 
@@ -140,6 +141,13 @@ func (m *Manager) InitByFiles() error {
 }
 
 func (m *Manager) initFile(baseName string) error {
+	// Validate baseName to prevent directory traversal and absolute path
+	if err := pathutil.VerifyFileName(baseName); err != nil {
+		return err
+	}
+	if filepath.IsAbs(baseName) || strings.Contains(baseName, "/") || strings.Contains(baseName, "\\") || strings.Contains(baseName, "..") {
+		return fmt.Errorf("invalid service file name: %q", baseName)
+	}
 	serviceConf := &conf{}
 	err := filex.ReadJsonUnmarshal(filepath.Join(m.etcDir, baseName), serviceConf)
 	if err != nil {

pkg/path/path.go

@@ -15,7 +15,9 @@
 package path
 
 import (
+	"fmt"
 	"path/filepath"
+	"strings"
 
 	"github.com/lf-edge/ekuiper/contract/v2/api"
 )
@@ -26,3 +28,18 @@ func AbsPath(ctx api.StreamContext, path string) string {
 	}
 	return filepath.Join(ctx.GetRootPath(), path)
 }
+
+func VerifyFileName(name string) error {
+	if strings.Contains(name, "..") || filepath.IsAbs(name) {
+		return fmt.Errorf("invalid file name: path traversal or absolute paths are not allowed: %q", name)
+	}
+	return nil
+}
+
+func IsSafeFileComponent(name string) bool {
+	// Disallow path separators and parent directory references.
+	if strings.Contains(name, "/") || strings.Contains(name, "\\") || strings.Contains(name, "..") || name == "" {
+		return false
+	}
+	return true
+}