[Aikido] AI Fix for Potential file inclusion attack via reading file

data/datacreator.ts

@@ -38,10 +38,15 @@ const entities = new Entities()
 const readFile = util.promisify(fs.readFile)
 
 function loadStaticData (file: string) {
-  const filePath = path.resolve('./data/static/' + file + '.yml')
-  return readFile(filePath, 'utf8')
+  const base = path.resolve('./data/static/')
+  const target = path.resolve(base, file + '.yml')
+  const relative = path.relative(base, target)
+  if (relative.startsWith('..') || path.isAbsolute(relative)) {
+    throw new Error('Invalid file path')
+  }
+  return readFile(target, 'utf8')
     .then(safeLoad)
-    .catch(() => logger.error('Could not open file: "' + filePath + '"'))
+    .catch(() => logger.error('Could not open file: "' + target + '"'))
 }
 
 module.exports = async () => {

lib/codingChallenges.ts

@@ -20,9 +20,16 @@ export const findFilesWithCodeChallenges = async (paths: readonly string[]): Pro
   for (const currPath of paths) {
     if ((await fs.lstat(currPath)).isDirectory()) {
       const files = await fs.readdir(currPath)
-      const moreMatches = await findFilesWithCodeChallenges(
-        files.map(file => path.resolve(currPath, file))
-      )
+      const base = path.resolve(currPath)
+      const resolvedFiles = files.map(file => {
+        const target = path.resolve(base, file)
+        const relative = path.relative(base, target)
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+          throw new Error('Invalid file path')
+        }
+        return target
+      })
+      const moreMatches = await findFilesWithCodeChallenges(resolvedFiles)
       matches.push(...moreMatches)
     } else {
       try {

routes/dataErasure.ts

@@ -66,7 +66,12 @@ router.post('/', async (req: Request<Record<string, unknown>, Record<string, unk
 
     res.clearCookie('token')
     if (req.body.layout) {
-      const filePath: string = path.resolve(req.body.layout).toLowerCase()
+      const userInput = req.body.layout
+      if (userInput.includes('..') || path.isAbsolute(userInput)) {
+        next(new Error('Invalid input'))
+        return
+      }
+      const filePath: string = path.resolve(userInput).toLowerCase()
       const isForbiddenFile: boolean = (filePath.includes('ftp') || filePath.includes('ctf.key') || filePath.includes('encryptionkeys'))
       if (!isForbiddenFile) {
         res.render('dataErasureResult', {

routes/fileUpload.ts

@@ -26,7 +26,13 @@ function handleZipFileUpload ({ file }: Request, res: Response, next: NextFuncti
     if (((file?.buffer) != null) && !utils.disableOnContainerEnv()) {
       const buffer = file.buffer
       const filename = file.originalname.toLowerCase()
-      const tempFile = path.join(os.tmpdir(), filename)
+      const tmpBase = path.resolve(os.tmpdir())
+      const tempFile = path.resolve(tmpBase, filename)
+      const tempFileRelative = path.relative(tmpBase, tempFile)
+      if (tempFileRelative.startsWith('..') || path.isAbsolute(tempFileRelative)) {
+        res.status(400).end()
+        return
+      }
       fs.open(tempFile, 'w', function (err, fd) {
         if (err != null) { next(err) }
         fs.write(fd, buffer, 0, buffer.length, null, function (err) {
@@ -36,10 +42,12 @@ function handleZipFileUpload ({ file }: Request, res: Response, next: NextFuncti
               .pipe(unzipper.Parse())
               .on('entry', function (entry: any) {
                 const fileName = entry.path
-                const absolutePath = path.resolve('uploads/complaints/' + fileName)
+                const base = path.resolve('uploads/complaints/')
+                const absolutePath = path.resolve(base, fileName)
+                const relativePath = path.relative(base, absolutePath)
                 challengeUtils.solveIf(challenges.fileWriteChallenge, () => { return absolutePath === path.resolve('ftp/legal.md') })
-                if (absolutePath.includes(path.resolve('.'))) {
-                  entry.pipe(fs.createWriteStream('uploads/complaints/' + fileName).on('error', function (err) { next(err) }))
+                if (!relativePath.startsWith('..') && !path.isAbsolute(relativePath) && absolutePath.includes(path.resolve('.'))) {
+                  entry.pipe(fs.createWriteStream(absolutePath).on('error', function (err) { next(err) }))
                 } else {
                   entry.autodrain()
                 }

routes/keyServer.ts

@@ -11,7 +11,15 @@ module.exports = function serveKeyFiles () {
     const file = params.file
 
     if (!file.includes('/')) {
-      res.sendFile(path.resolve('encryptionkeys/', file))
+      const base = path.resolve('encryptionkeys/')
+      const target = path.resolve(base, file)
+      const relative = path.relative(base, target)
+      if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        res.status(403)
+        next(new Error('Invalid file path!'))
+      } else {
+        res.sendFile(target)
+      }
     } else {
       res.status(403)
       next(new Error('File names cannot contain forward slashes!'))

routes/logfileServer.ts

@@ -11,7 +11,15 @@ module.exports = function serveLogFiles () {
     const file = params.file
 
     if (!file.includes('/')) {
-      res.sendFile(path.resolve('logs/', file))
+      const base = path.resolve('logs/')
+      const target = path.resolve(base, file)
+      const relative = path.relative(base, target)
+      if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        res.status(403)
+        next(new Error('Invalid file path!'))
+      } else {
+        res.sendFile(target)
+      }
     } else {
       res.status(403)
       next(new Error('File names cannot contain forward slashes!'))

routes/quarantineServer.ts

@@ -11,7 +11,15 @@ module.exports = function serveQuarantineFiles () {
     const file = params.file
 
     if (!file.includes('/')) {
-      res.sendFile(path.resolve('ftp/quarantine/', file))
+      const base = path.resolve('ftp/quarantine/')
+      const target = path.resolve(base, file)
+      const relative = path.relative(base, target)
+      if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        res.status(403)
+        next(new Error('Invalid file path!'))
+      } else {
+        res.sendFile(target)
+      }
     } else {
       res.status(403)
       next(new Error('File names cannot contain forward slashes!'))

routes/vulnCodeFixes.ts

@@ -4,6 +4,7 @@ import * as accuracy from '../lib/accuracy'
 const challengeUtils = require('../lib/challengeUtils')
 const fs = require('fs')
 const yaml = require('js-yaml')
+const path = require('path')
 
 const FixesDir = 'data/static/codefixes'
 
@@ -76,8 +77,11 @@ export const checkCorrectFix = () => async (req: Request<Record<string, unknown>
     })
   } else {
     let explanation
-    if (fs.existsSync('./data/static/codefixes/' + key + '.info.yml')) {
-      const codingChallengeInfos = yaml.load(fs.readFileSync('./data/static/codefixes/' + key + '.info.yml', 'utf8'))
+    const base = path.resolve('./data/static/codefixes')
+    const target = path.resolve(base, key + '.info.yml')
+    const relative = path.relative(base, target)
+    if (!relative.startsWith('..') && !path.isAbsolute(relative) && fs.existsSync(target)) {
+      const codingChallengeInfos = yaml.load(fs.readFileSync(target, 'utf8'))
       const selectedFixInfo = codingChallengeInfos?.fixes.find(({ id }: { id: number }) => id === selectedFix + 1)
       if (selectedFixInfo?.explanation) explanation = res.__(selectedFixInfo.explanation)
     }

routes/vulnCodeSnippet.ts

@@ -90,8 +90,11 @@ exports.checkVulnLines = () => async (req: Request<Record<string, unknown>, Reco
   const selectedLines: number[] = req.body.selectedLines
   const verdict = getVerdict(vulnLines, neutralLines, selectedLines)
   let hint
-  if (fs.existsSync('./data/static/codefixes/' + key + '.info.yml')) {
-    const codingChallengeInfos = yaml.load(fs.readFileSync('./data/static/codefixes/' + key + '.info.yml', 'utf8'))
+  const base = path.resolve('./data/static/codefixes')
+  const target = path.resolve(base, key + '.info.yml')
+  const relative = path.relative(base, target)
+  if (!relative.startsWith('..') && !path.isAbsolute(relative) && fs.existsSync(target)) {
+    const codingChallengeInfos = yaml.load(fs.readFileSync(target, 'utf8'))
     if (codingChallengeInfos?.hints) {
       if (accuracy.getFindItAttempts(key) > codingChallengeInfos.hints.length) {
         if (vulnLines.length === 1) {

rsn/rsnUtil.ts

@@ -45,7 +45,13 @@ const checkDiffs = async (keys: string[]) => {
       .then(snippet => {
         if (snippet == null) return
         process.stdout.write(val + ': ')
-        const fileData = fs.readFileSync(fixesPath + '/' + val).toString()
+        const base = path.resolve(fixesPath)
+        const target = path.resolve(base, val)
+        const relative = path.relative(base, target)
+        if (relative.startsWith('..') || path.isAbsolute(relative)) {
+          throw new Error('Invalid file path')
+        }
+        const fileData = fs.readFileSync(target).toString()
         const diff = Diff.diffLines(filterString(fileData), filterString(snippet.snippet))
         let line = 0
         for (const part of diff) {
@@ -100,7 +106,13 @@ const checkDiffs = async (keys: string[]) => {
 }
 
 async function seePatch (file: string) {
-  const fileData = fs.readFileSync(fixesPath + '/' + file).toString()
+  const resolvedBase = path.resolve(fixesPath)
+  const resolvedTarget = path.resolve(resolvedBase, file)
+  const relativePath = path.relative(resolvedBase, resolvedTarget)
+  if (relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+    throw new Error('Invalid file path')
+  }
+  const fileData = fs.readFileSync(resolvedTarget).toString()
   const snippet = await retrieveCodeSnippet(file.split('_')[0])
   if (snippet == null) return
   const patch = Diff.structuredPatch(file, file, filterString(snippet.snippet), filterString(fileData))