Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for content type probing for static files. #255

Closed
wants to merge 1 commit into from

Conversation

kothar
Copy link

@kothar kothar commented Apr 29, 2019

Issue #254

Description of changes:
Prefix non-absolute paths with "/tmp" when probing MIME type. This is a working fix to #254 provided as an example, but may need some additional randomisation adding to the path to avoid any potential collision with actually existing files in /tmp. Also not yet compared to behaviour of frameworks other than Spring Boot.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

@sapessi
Copy link
Collaborator

sapessi commented May 6, 2019

Perhaps instead of going to /tmp we should point to the task root (/var/task). I'm planning to add a getTaskRoot method to the ContainerConfig object that relies on the Lambda environment variable when available.

@kothar
Copy link
Author

kothar commented May 7, 2019

@sapessi, assuming that the path requested ('favicon.ico' for example) won't be a literal mapping onto a file in /var/task (more likely '/var/task/static/favicon.ico' or embedded inside a jar file), do you agree that it should be assumed we aren't trying to map to a real file, and ensure that the path is randomised to avoid leaking any information about real files in the function package?

Any path under /var/task or /tmp would pass the security check, and I agree /var/task is probably preferable.

@sapessi
Copy link
Collaborator

sapessi commented May 7, 2019

Agree 100% on not leaking information @kothar. That's why I'd rather avoid /tmp. The temp directory is writable inside Lambda and may be used to store some state. I'll do some digging to figure out if there's a way to get the absolute path out of Spring.

@sapessi
Copy link
Collaborator

sapessi commented Jun 27, 2019

Closing this PR since the fix was implemented based on the discussion on issue #254

@sapessi sapessi closed this Jun 27, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants