More secure path mangling

src/actinia_core/core/utils.py

@@ -28,15 +28,16 @@
 import os
 from actinia_core.core.common.process_object import Process
 from actinia_core.core.common.exceptions import SecurityError
+from actinia_core.core.common.config import global_config
 
 __license__ = "GPLv3"
 __author__ = "Sören Gebbert, Anika Weinmann"
 __copyright__ = "Copyright 2016-2021, Sören Gebbert and mundialis GmbH & Co. KG"
 __maintainer__ = "mundialis"
 
 
-def os_path_normpath(path_parts):
-    """The function returns a joined norm path or raises an error if it is not
+def ensure_valid_path(path_parts):
+    """The function returns a joined and normalized path or raises an error if it is not
     as expected.
 
     Args:
@@ -49,11 +50,22 @@ def os_path_normpath(path_parts):
         raises a SecurityError if the path is not as expected
     """
     path = os.path.normpath(os.path.join(*path_parts))
-    if not path.startswith(path_parts[0]):
+    if not path.startswith(path_parts[0]) or not path_is_in_allowed_paths(path):
         raise SecurityError(f"Used path '{path}' is insecure")
     return path
 
 
+def path_is_in_allowed_paths(path):
+    # TODO we should double check whether they are all needed, better would be one
+    # single location
+    allowed_starts = [
+        global_config.GRASS_USER_DATABASE,
+        global_config.GRASS_DATABASE,
+        global_config.GRASS_RESOURCE_DIR
+    ]
+    return any(path.startswith(allowed) for allowed in allowed_starts)
+
+
 def get_wget_process(source, url):
     """The function returns a wget Process for the given source and url
 

src/actinia_core/rest/resource_streamer.py

@@ -31,7 +31,7 @@
 from actinia_core.core.common.config import global_config
 from actinia_core.core.common.app import auth
 from actinia_core.core.common.api_logger import log_api_call
-from actinia_core.core.utils import os_path_normpath
+from actinia_core.core.utils import ensure_valid_path
 
 
 __license__ = "GPLv3"
@@ -84,9 +84,9 @@ def get(self, user_id, resource_id, file_name):
         """
 
         resource_dir = global_config.GRASS_RESOURCE_DIR
-        user_export_path = os_path_normpath([resource_dir, user_id])
-        resource_export_path = os_path_normpath([user_export_path, resource_id])
-        resource_export_file_path = os_path_normpath([resource_export_path,
+        user_export_path = ensure_valid_path([resource_dir, user_id])
+        resource_export_path = ensure_valid_path([user_export_path, resource_id])
+        resource_export_file_path = ensure_valid_path([resource_export_path,
                                                       file_name])
 
         if (os.path.exists(resource_export_file_path) is True