From 5e0b68f3737ec29595bf92c8ce209702f5bd80be Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ludovic=20Court=C3=A8s?= Date: Mon, 8 Jun 2026 23:50:14 +0200 Subject: narinfo: Reject narinfos where store file names are invalid. MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This change safeguards against narinfos that would advertise “StorePath: /gnu/store/…-foo/../../../etc/passwd” or similar, which could otherwise propagate down the line and lead to attempts to overwrite said file, should ‘guix-daemon’ be running as root. * guix/narinfo.scm (narinfo-maker): Validate ‘path’, ‘references’, and ‘deriver’ and return #f upon failure. (read-narinfo, string->narinfo): Adjust docstring accordingly. * guix/substitutes.scm (fetch-narinfos): Remove check for ‘narinfo-path’ prefix; instead check whether ‘read-narinfo’ returned true. (cached-narinfo): Check whether ‘string->narinfo’ returned true. * tests/substitute.scm ("query narinfo that contains invalid store path"): New test. Change-Id: I0be2ea88b7f762144fca35373363364df3264b5a Signed-off-by: Ludovic Courtès --- tests/substitute.scm | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) (limited to 'tests') diff --git a/tests/substitute.scm b/tests/substitute.scm index 6837e7e868e..8f32bfa7281 100644 --- a/tests/substitute.scm +++ b/tests/substitute.scm @@ -1,6 +1,6 @@ ;;; GNU Guix --- Functional package management for GNU ;;; Copyright © 2014 Nikita Karetnikov -;;; Copyright © 2014-2015, 2017-2019, 2021-2023 Ludovic Courtès +;;; Copyright © 2014-2015, 2017-2019, 2021-2023, 2026 Ludovic Courtès ;;; ;;; This file is part of GNU Guix. ;;; @@ -333,6 +333,30 @@ Deriver: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo.drv") (lambda () (guix-substitute "--query"))))))))) +(test-equal "query narinfo that contains invalid store path" + ;; The signature covers the StorePath/NarHash/References tuple, so it is + ;; valid, but the 'StorePath' field is invalid (contains forbidden + ;; characters). + "" + + (let ((prefix (string-append "StorePath: " (%store-prefix) + "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo/../../../etc/passwd +NarHash: sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa +References: bar baz\n"))) + (with-narinfo (string-append prefix + "Signature: " (signature-field prefix) " +URL: example.nar +Compression: none +NarSize: 42 +Deriver: foo.drv") + (string-trim-both + (with-output-to-string + (lambda () + (with-input-from-string (string-append "have " (%store-prefix) + "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo") + (lambda () + (guix-substitute "--query"))))))))) + (test-equal "query narinfo signed with authorized key" (string-append (%store-prefix) "/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-foo") -- cgit v1.2.3