remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-25 17:57:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

fix(plugins): confine plugin filesystem mounts to their root (#5881)

Browse source 
* fix(plugins): confine plugin filesystem mounts to their root

A plugin granted read-write filesystem access could escape its mount by
creating a relative symlink inside it and then writing through that link,
reaching any path the server process can write, including navidrome.db.

wazero resolves guest paths by concatenating them onto the host root. Its
WASI layer validates every path argument except the symlink target, which
path_symlink forwards unvalidated by design, and fs.ValidPath splits on
"/" only, so on Windows a "..\" path escapes the mount as well.

Mounts now go through a jailedFS wrapper that denies symlink creation and
rejects any path that is not filepath.IsLocal. That requires bypassing
extism's AllowedPaths, which discards any FSConfig passed alongside it, so
the mounts are built directly and applied per instance instead. Following
symlinks that already exist in a mount is unchanged: music libraries rely
on it, and read-only mounts already reject creating new ones.

* test(plugins): guard against setting extism AllowedPaths

Extracts the extism manifest construction so a test can assert AllowedPaths
is never set. Setting it makes extism build its own FSConfig and discard the
jailed mounts, silently restoring the symlink escape.

Verified by simulating the regression: with AllowedPaths populated for plugins
holding the filesystem permission, the new spec fails, as do two of the
end-to-end sandbox specs.
This commit is contained in:
Deluan Quintão 2026-08-02 12:27:08 -04:00 • committed by GitHub
commit 810b14ed57
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 572 additions and 143 deletions
Download patch file Download diff file Expand all files Collapse all files

26
plugins/testdata/test-library/main.go vendored
View file

@ -14,10 +14,12 @@ import (
// TestLibraryInput is the input for nd_test_library callback.
type TestLibraryInput struct {
Operation string `json:"operation"` // "get_library", "get_all_libraries", "read_file", "list_dir"
Operation string `json:"operation"` // "get_library", "get_all_libraries", "read_file", "list_dir", "write_file", "symlink"
LibraryID int32 `json:"library_id,omitempty"`
MountPoint string `json:"mount_point,omitempty"` // For filesystem operations
FilePath string `json:"file_path,omitempty"` // For read_file operation (relative to mount point)
Content string `json:"content,omitempty"` // For write_file operation
Target string `json:"target,omitempty"` // For symlink operation
}
// TestLibraryOutput is the output from nd_test_library callback.
@ -88,6 +90,28 @@ func ndTestLibrary() int32 {
pdk.OutputJSON(TestLibraryOutput{DirEntries: names})
return 0
case "write_file":
// Write a file to the mounted library directory
fullPath := filepath.Join(input.MountPoint, input.FilePath)
if err := os.WriteFile(fullPath, []byte(input.Content), 0600); err != nil {
errStr := err.Error()
pdk.OutputJSON(TestLibraryOutput{Error: &errStr})
return 0
}
pdk.OutputJSON(TestLibraryOutput{})
return 0
case "symlink":
// Create a symlink inside the mounted library directory
fullPath := filepath.Join(input.MountPoint, input.FilePath)
if err := os.Symlink(input.Target, fullPath); err != nil {
errStr := err.Error()
pdk.OutputJSON(TestLibraryOutput{Error: &errStr})
return 0
}
pdk.OutputJSON(TestLibraryOutput{})
return 0
default:
errStr := "unknown operation: " + input.Operation
pdk.OutputJSON(TestLibraryOutput{Error: &errStr})