Skip to content

Fix independently-verified findings from a security audit #7503

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ewels merged 3 commits into from
Aug 20, 2026
Merged

Fix independently-verified findings from a security audit #7503

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4522d9f
Fix independently-verified findings from a security audit
ewels Aug 18, 2026
2d07bcd
Apply suggestion from @ewels
ewels Aug 18, 2026
df929ee
Fix docker entrypoint injection and restore refresh error logging
ewels Aug 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions docker/entry.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,6 @@
# enable debugging
[[ "$NXF_DEBUG_ENTRY" ]] && set -x

# wrap cli args with single quote to avoid wildcard expansion
cli=''; for x in "$@"; do cli+="'$x' "; done

# the NXF_USRMAP hold the user ID in the host environment
if [[ "$NXF_USRMAP" ]]; then
# create a `nextflow` user with the provided ID
Expand All @@ -50,6 +47,11 @@ useradd -u "$NXF_USRMAP" -G docker -s /bin/bash nextflow
chown nextflow /var/run/docker.sock
chown -R nextflow /.nextflow

# `su` only accepts a command string, so re-quote each arg with `%q`
# (not a hand-rolled `'$x'` wrap, which breaks — and lets the arg escape
# the quoting — the moment an arg contains a single quote).
cli=''; for x in "$@"; do printf -v esc '%q' "$x"; cli+="$esc "; done
Comment thread
ewels marked this conversation as resolved.
Outdated

# finally run the target command with `nextflow` user
su nextflow << EOF
[[ "$NXF_DEBUG_ENTRY" ]] && set -x
Expand All @@ -58,5 +60,5 @@ EOF

# otherwise just execute the command
else
exec bash -c "$cli"
exec "$@"
fi
1 change: 1 addition & 0 deletions gradle/wrapper/gradle-wrapper.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14
distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
networkTimeout=10000
retries=0
Expand Down
2 changes: 2 additions & 0 deletions modules/nextflow/src/main/groovy/nextflow/util/RemoteSession.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,6 +149,8 @@ class RemoteSession implements Serializable, Closeable {
while( (entry=zip.getNextEntry()) != null ) {

def file = target.resolve(entry.getName());
if( !file.normalize().startsWith(target.normalize()) )
throw new IllegalArgumentException("Unsafe zip entry path: ${entry.getName()}")
if(entry.isDirectory()) {
continue
}
Expand Down
7 changes: 4 additions & 3 deletions plugins/nf-tower/src/main/io/seqera/tower/plugin/TowerXAuth.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ import groovy.util.logging.Slf4j
import io.seqera.http.HxProxyConfig
import nextflow.file.http.XAuthProvider
import nextflow.util.ProxyConfig
import nextflow.util.StringUtils

/**
* Implements Tower authentication strategy for resources accessed
Expand Down Expand Up @@ -96,7 +97,7 @@ class TowerXAuth implements XAuthProvider {
.build()

final resp = httpClient.send(req, HttpResponse.BodyHandlers.ofString())
log.debug "Refresh cookie response: [${resp.statusCode()}] ${resp.body()}"
log.debug "Refresh cookie response: [${resp.statusCode()}]"
Comment thread
ewels marked this conversation as resolved.
Outdated
if( resp.statusCode() != 200 )
return false

Expand All @@ -105,7 +106,7 @@ class TowerXAuth implements XAuthProvider {

// set the new bearer token in the current client session
if( authCookie?.value ) {
log.trace "Updating http client bearer token=$authCookie.value"
log.trace "Updating http client bearer token=${StringUtils.redact(authCookie.value)}"
accessToken = authCookie.value
}
else {
Expand All @@ -114,7 +115,7 @@ class TowerXAuth implements XAuthProvider {

// set the new refresh token
if( refreshCookie?.value ) {
log.trace "Updating http client refresh token=$refreshCookie.value"
log.trace "Updating http client refresh token=${StringUtils.redact(refreshCookie.value)}"
refreshToken = refreshCookie.value
}
else {
Expand Down
Loading