narinfo: Reject narinfos where store file names are invalid.

This change safeguards against narinfos that would advertise
“StorePath: /gnu/store/…-foo/../../../etc/passwd” or similar, which could
otherwise propagate down the line and lead to attempts to overwrite said file,
should ‘guix-daemon’ be running as root.

* guix/narinfo.scm (narinfo-maker): Validate ‘path’, ‘references’, and
‘deriver’ and return #f upon failure.
(read-narinfo, string->narinfo): Adjust docstring accordingly.
* guix/substitutes.scm (fetch-narinfos): Remove check for ‘narinfo-path’
prefix; instead check whether ‘read-narinfo’ returned true.
(cached-narinfo): Check whether ‘string->narinfo’ returned true.
* tests/substitute.scm ("query narinfo that contains invalid store path"): New
test.

Change-Id: I0be2ea88b7f762144fca35373363364df3264b5a
Signed-off-by: Ludovic Courtès <ludo@gnu.org>

1 files changed, 25 insertions, 1 deletions

diff --git a/tests/substitute.scm b/tests/substitute.scm
index 6837e7e868e..8f32bfa7281 100644
--- a/tests/substitute.scm
+++ b/tests/substitute.scm
@@ -1,6 +1,6 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2014 Nikita Karetnikov <nikita@karetnikov.org>
-;;; Copyright © 2014-2015, 2017-2019, 2021-2023 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2014-2015, 2017-2019, 2021-2023, 2026 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -333,6 +333,30 @@ Deriver: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo.drv")
              (lambda ()
                (guix-substitute "--query")))))))))
 
+(test-equal "query narinfo that contains invalid store path"
+  ;; The signature covers the StorePath/NarHash/References tuple, so it is
+  ;; valid, but the 'StorePath' field is invalid (contains forbidden
+  ;; characters).
+  ""
+
+  (let ((prefix (string-append "StorePath: " (%store-prefix)
+                               "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo/../../../etc/passwd
+NarHash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+References: bar baz\n")))
+    (with-narinfo (string-append prefix
+                                 "Signature: " (signature-field prefix) "
+URL: example.nar
+Compression: none
+NarSize: 42
+Deriver: foo.drv")
+      (string-trim-both
+       (with-output-to-string
+         (lambda ()
+           (with-input-from-string (string-append "have " (%store-prefix)
+                                                  "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo")
+             (lambda ()
+               (guix-substitute "--query")))))))))
+
 (test-equal "query narinfo signed with authorized key"
   (string-append (%store-prefix) "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo")