Repository navigation
fix: backport three security fixes from 0.71/0.72 - #212
Merged
Merged
Conversation
Reject any filename that is not a local relative path via filepath.IsLocal before opening the destination file. GHSA-mcj4-mphf-j9ff (cherry picked from commit a72d9a4)
Adopt Go's os.Root for plugin file operations so that all path access derived from a plugin name stays within the plugin root (~/.trivy/plugins). Add pkg/x/os.Root, a small wrapper over os.Root with a Join helper, and route install, uninstall, and plugin loading through it instead of joining names onto the root path directly. NewManager opens the plugin root eagerly and returns an error, and exposes Close; the package-level Run/Start helpers wrap it for callers outside the plugin subcommands. (cherry picked from commit d4213d7)
Upstream fixed this in 0.71.0 by replacing the custom Helm archive parser with the Helm SDK loaders (#10718) - 143 files, +1746/-6984. That is far too much to backport onto this branch, so this applies the same protection to the parser we have. unpackArchive read every regular entry with io.ReadAll(tr) and no limit, so a small crafted .tgz could expand to gigabytes and OOM the scanner. It now enforces the Helm SDK's own published limits, taken from the loader package this tree already depends on (helm.sh/helm/v3 v3.20.2): loader.MaxDecompressedFileSize 5 MiB per entry loader.MaxDecompressedChartSize 100 MiB per archive The per-archive budget is decremented by bytes actually read, via io.LimitReader(tr, remaining+1), so a header that understates the entry size is caught rather than trusted. A chart Helm itself would refuse to load is now refused here too. Also drops the unused xslices import that came in with the plugin-manager backport: upstream had refactored lo.Map to xslices.Map in unrelated cleanup, and this branch still uses lo.Map. Verified: go build ./pkg/... ./cmd/... passes, and go test for pkg/iac/scanners/helm/..., pkg/plugin/... and pkg/oci/... is green, including the escaping_name / absolute_name plugin cases the CVE-2026-63328 backport adds. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
📊 API Changes DetectedSemver impact: |
The two cherry-picked backports carry upstream tests (pkg/oci/artifact_test.go for CVE-2026-55092; manager_test.go, manager_unix_test.go, pkg/x/os/root_test.go and the absolute_name / escaping_name plugin fixtures for CVE-2026-63328). The hand-written CVE-2026-54448 fix had none, so this adds one. The test builds gzipped tars whose entries are zero bytes on disk but declare large sizes - the shape of a decompression bomb - and asserts three things: an entry over the per-file limit is rejected, entries that together exceed the per-archive budget are rejected, and an archive within both limits still parses. Helm exports its limits as vars, so the test lowers them and restores them in t.Cleanup rather than building a 100 MiB fixture. Confirmed to be a real regression test: with parser_tar.go reverted to the pre-fix version both failing cases fail, and they pass again with the fix. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
harbor-helm restored its per-image trivy gate to
exitCode 1, and the scan ofgoharbor-trivy-adapter-photonthen failed on three findings in the trivy binary itself - all fixed only on release lines newer than this one:io.ReadAll, so a small.tgzcan expand to gigabytes and OOM the scannerorg.opencontainers.image.titleannotation is used as the destination filename without validationa72d9a4d)~/.trivy/pluginswithout confining them to that rootd4213d77)Moving this fork to 0.71/0.72 would mean four minor versions of behaviour change to re-validate against harbor-scanner-trivy, so this backports the fixes instead.
What is in here
a72d9a4dcherry-picked as-is (CVE-2026-55092) - clean, 2 files, +36/-1.d4213d77cherry-picked (CVE-2026-63328) - one import conflict only; brings upstreampkg/x/os/root.go(rooted writes) plus theabsolute_name/escaping_nameplugin test data. The unusedxslicesimport is dropped: upstream had also refactoredlo.Maptoxslices.Map, which this branch does not have.CVE-2026-54448 reimplemented minimally. Upstream replaced the whole parser with the Helm SDK loaders - 143 files, +1746/-6984 - which is not backportable here. Instead
unpackArchivenow enforces the Helm SDK's own published limits, from theloaderpackage this tree already depends on (helm.sh/helm/v3 v3.20.2):loader.MaxDecompressedFileSize(5 MiB) per entryloader.MaxDecompressedChartSize(100 MiB) per archiveThe archive budget is decremented by bytes actually read, via
io.LimitReader(tr, remaining+1), so an entry whose real size exceeds its header is caught rather than trusted. Net +20 lines. A chart Helm itself would refuse to load is now refused here too.Test plan
go build ./pkg/... ./cmd/...passesgo test ./pkg/iac/scanners/helm/... ./pkg/plugin/... ./pkg/oci/...green, including the two malicious-plugin cases the CVE-2026-63328 backport addsv0.68.3-alauda-12, then bumpTRIVY_VERSIONin harbor-helm.tekton/all-in-one.yamland confirmbuild-trivy-adapter-scangoes green on its own merit🤖 Generated with Claude Code