daemon: libstore: reject invalid store paths in importPath.

Previously an authorized substitute server could produce invalid store paths -
that is, paths that do denote a top-level file in the store, but that do not
obey the syntax restrictions beyond what that implies.  Given that an
authorized substitute server can already potentially do a lot of damage if it
really wanted to, this isn't a major issue, but closing off this opportunity
does simplify the analysis somewhat.

* nix/libstore/local-store.cc (LocalStore::importPath): use
  strict readStorePath(s) variants.
* tests/store.scm ("import path not in store, unsigned", "import path not in
  store, signed", "import invalid path, unsigned", "import invalid path,
  signed" test cases): new test cases.  The "not in store" cases succeeded
  previously, while the "invalid path" cases did not succeed prior to this
  commit.

Fixes: guix/guix#9078
Change-Id: Ib81c19ec1ae0fff5b7c7268f4f7429b16a870996
Signed-off-by: Ludovic Courtès <ludo@gnu.org>
Merges: #9434

1 files changed, 7 insertions, 3 deletions

diff --git a/nix/libstore/local-store.cc b/nix/libstore/local-store.cc
index b8308b1aae5..478f2ccc44f 100644
--- a/nix/libstore/local-store.cc
+++ b/nix/libstore/local-store.cc
@@ -1340,12 +1340,16 @@ Path LocalStore::importPath(bool requireSignature, Source & source)
     if (magic != EXPORT_MAGIC)
         throw Error("normalized archive cannot be imported; wrong format");
 
-    Path dstPath = readStorePath(hashAndReadSource);
+    /* The path being imported must at least be syntactically valid.  This
+     * doesn't guarantee that it can be constructed by some existing method,
+     * but it at least rules out paths like "/gnu/store/nix-12982-1" or
+     * "/gnu/store/." or "/gnu/store/..". */
+    Path dstPath = readStorePathStrict(hashAndReadSource);
 
-    PathSet references = readStorePaths<PathSet>(hashAndReadSource);
+    PathSet references = readStorePathsStrict<PathSet>(hashAndReadSource);
 
     Path deriver = readString(hashAndReadSource);
-    if (deriver != "") assertStorePath(deriver);
+    if (deriver != "") assertStorePathStrict(deriver);
 
     Hash hash = hashAndReadSource.hashSink.finish().first;
     hashAndReadSource.hashing = false;