fix(sync): reject --subdir that escapes --dest

dest_root = os.path.join(--dest, --subdir) let an absolute --subdir
discard --dest entirely, and a --subdir containing .. walk out of the
dest tree; copy mode then shutil.copy2-overwrote files there. Require
--subdir to be relative and to resolve to a path inside --dest.

Adds tests/test_wolfglass_sync.py (absolute and .. rejected, relative
copies inside) and wires it into selftest.yml.

Author: MarkAtwood

.github/workflows/selftest.yml

@@ -33,10 +33,14 @@ jobs:
             provenance/bomsh_verify.py \
             tools/wolfglass-sync \
             tests/test_gen_sbom.py \
-            tests/test_sbom.py
+            tests/test_sbom.py \
+            tests/test_wolfglass_sync.py
 
       - name: Run generator unit tests
         run: python -m unittest tests/test_gen_sbom.py
 
+      - name: Run wolfglass-sync tests
+        run: python -m unittest tests/test_wolfglass_sync.py
+
       - name: Run self-test
         run: python tests/test_sbom.py

tests/test_wolfglass_sync.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""Tests for tools/wolfglass-sync, focused on the --subdir containment guard.
+
+--subdir is joined onto --dest and then written into, so an absolute value or
+one containing .. must be refused rather than allowed to place/overwrite files
+outside the product's vendoring path."""
+
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+
+REPO = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+SYNC = os.path.join(REPO, "tools", "wolfglass-sync")
+
+
+def _run(dest, subdir):
+    return subprocess.run(
+        [sys.executable, SYNC, "--dest", dest, "--subdir", subdir],
+        capture_output=True, text=True)
+
+
+class TestSubdirContainment(unittest.TestCase):
+    def test_relative_subdir_copies_inside_dest(self):
+        with tempfile.TemporaryDirectory() as dest:
+            r = _run(dest, "tools/sbom")
+            self.assertEqual(r.returncode, 0, r.stderr)
+            # gen-sbom is part of share/, so it must land under the subdir.
+            self.assertTrue(
+                os.path.isfile(os.path.join(dest, "tools", "sbom", "gen-sbom")),
+                os.listdir(dest))
+
+    def test_absolute_subdir_rejected(self):
+        with tempfile.TemporaryDirectory() as dest, \
+                tempfile.TemporaryDirectory() as outside:
+            target = os.path.join(outside, "pwned")
+            r = _run(dest, target)               # absolute path
+            self.assertNotEqual(r.returncode, 0)
+            self.assertIn("--subdir", r.stderr)
+            self.assertFalse(os.path.exists(target),
+                             "absolute --subdir wrote outside --dest")
+
+    def test_dotdot_subdir_rejected(self):
+        with tempfile.TemporaryDirectory() as parent:
+            dest = os.path.join(parent, "product")
+            os.mkdir(dest)
+            r = _run(dest, "../escape")
+            self.assertNotEqual(r.returncode, 0)
+            self.assertIn("escapes --dest", r.stderr)
+            self.assertFalse(os.path.exists(os.path.join(parent, "escape")),
+                             "../ --subdir wrote outside --dest")
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)

tools/wolfglass-sync

@@ -50,7 +50,20 @@ def main():
     if not os.path.isdir(share_dir):
         sys.exit(f"ERROR: no share/ directory at {share_dir}")
 
+    # --subdir is joined onto --dest and then written into. An absolute value
+    # (os.path.join discards --dest) or one containing .. would place and
+    # overwrite files outside the product's vendoring path, so require it to
+    # resolve to a location inside --dest.
+    if os.path.isabs(args.subdir):
+        sys.exit(f"ERROR: --subdir must be relative to --dest, got absolute "
+                 f"{args.subdir!r}.")
     dest_root = os.path.join(args.dest, args.subdir)
+    dest_abs = os.path.realpath(args.dest)
+    dest_root_abs = os.path.realpath(dest_root)
+    if dest_root_abs != dest_abs and \
+            not dest_root_abs.startswith(dest_abs + os.sep):
+        sys.exit(f"ERROR: --subdir {args.subdir!r} escapes --dest; it must "
+                 f"resolve to a path inside {args.dest!r}.")
     files = sorted(iter_share_files(share_dir), key=lambda p: p[1])
 
     if args.check: