Repository navigation
Router allows exec paths hidden behind dot segments (/./exec, /x/../exec) #70
Description
Describe the bug
The router allows exec paths hidden behind dot segments. GET /./exec/<id>/json and GET /x/../exec/<id>/json have a first segment of . or x, so the exec check (#49) does not match and the GET passthrough forwards them. This is the same class as the //exec/... bypass fixed for #55 (empty path segment not allowed), which only covers empty segments.
Found in the review of the #55 Task 3 PR. Router-level probe on that branch (Route("GET", path)):
| Path | Go | TS | Rust |
|---|---|---|---|
/./exec/abc/json |
Allow | Allow | Allow (by code reading, not probed) |
/x/../exec/abc/json |
Allow | Allow | Allow (by code reading, not probed) |
/containers/./mycontainer/exec |
Deny (exec) | Deny (exec) | Deny (exec) |
Impact: as with // before #55, a live daemon is expected to answer dot-segment paths with a 301 to the clean path, so nothing should leak. A client that follows the redirect re-enters the proxy on the clean path and is denied. But the router allows an exec path, which the spec's intent forbids, and it depends on daemon behaviour the proxy does not control.
Affected implementation(s)
- All
To Reproduce
- Any policy.
curl --path-as-is --unix-socket proxy.sock 'http://localhost/./exec/<id>/json'- The proxy forwards it (the daemon's answer, not a proxy 403).
Expected behavior
Deny any path with a . or .. segment for every method, right after the empty-segment check, e.g. dot path segment not allowed. Same check in Go, Rust and TS; a spec flag and property mirroring ALLOW_EMPTY_INTERIOR / emptySegmentsHideNoExec (exec path after dot-segment removal ⇒ denied); table rows in all three; an integration check with curl --path-as-is.
Alternatives considered:
- Normalise the path (RFC 3986 remove_dot_segments) and route on the result. Rejected: the proxy would then forward a path different from the one it routed, or have to rewrite it; denying is simpler and the Docker CLI never sends dot segments.
- Rely on the daemon's 301. Rejected for the same reason as Deferred minor findings from the #43/#47/#50/#51 review cycles #55: the router should not allow an exec path at all.
Environment
- Docker 29.4.0 (OrbStack), branch
fix/empty-segment-head-55.
Additional context
README.md and spec/README.md on that branch say dot segments are not denied yet.
Activity
abienkowski commentedon Oct 10, 2026
Note from the #71 review: in TypeScript, the denial of absolute-form request targets (
GET http://docker/exec/<id>/json, an exec-inspect leak in v0.3.1–v0.3.3) rests on the//check, because the TS router sees the raw target. Fix this issue by denying./..segments. Normalising the path instead, or dropping the//check, would reopen that leak; the TS router rowGET http://docker/exec/abc/jsonand the integration checkGET http://docker/exec/*/json -> 403 (absolute-form target)would catch it.fix: deny dot path segments in all three (#70) (#81)