1.0.34

src/lib/server/stacks.ts

@@ -5,8 +5,8 @@
  * All lifecycle operations use docker compose commands.
  */
 
-import { existsSync, mkdirSync, rmSync, readdirSync, cpSync, statSync, unlinkSync, renameSync, readFileSync, writeFileSync } from 'node:fs';
-import { join, resolve, dirname, basename } from 'node:path';
+import { existsSync, mkdirSync, rmSync, readdirSync, cpSync, statSync, unlinkSync, renameSync, readFileSync, writeFileSync, realpathSync } from 'node:fs';
+import { join, resolve, dirname, basename, normalize as pathNormalize, sep as pathSep } from 'node:path';
 import { spawn as nodeSpawn } from 'node:child_process';
 import type { ChildProcess } from 'node:child_process';
 import {
@@ -34,7 +34,9 @@ import {
 	removePendingContainerUpdate,
 	deleteAutoUpdateSchedule,
 	getAutoUpdateSetting,
-	getStackSourceByComposePath
+	getStackSourceByComposePath,
+	getExternalStackPaths,
+	addExternalStackPath
 } from './db';
 import { unregisterSchedule } from './scheduler';
 import { deleteGitStackFiles, parseEnvFileContent } from './git';
@@ -348,6 +350,125 @@ export async function getStackDir(stackName: string, envId?: number | null): Pro
 	return join(stacksDir, stackName);
 }
 
+/**
+ * Filenames a stack is allowed to write. Compose files in the conventional
+ * names + .env. Anything else is rejected even when the directory is in
+ * the allowlist, so this code path can only ever produce stack-shaped files.
+ */
+const ALLOWED_STACK_FILENAMES = new Set([
+	'docker-compose.yml',
+	'docker-compose.yaml',
+	'compose.yml',
+	'compose.yaml',
+	'.env'
+]);
+
+/**
+ * Resolve a path against the parent's realpath when the parent exists, so
+ * symlinks resolve to their canonical location. We can't realpath the leaf
+ * because the file may not exist yet (new stack).
+ */
+function resolveStackPath(input: string): string {
+	const abs = resolve(input);
+	const parent = dirname(abs);
+	try {
+		if (existsSync(parent)) {
+			return join(realpathSync(parent), basename(abs));
+		}
+	} catch {
+		// realpath may fail on permission errors; fall through to the plain resolve.
+	}
+	return abs;
+}
+
+function isInside(child: string, parent: string): boolean {
+	const c = pathNormalize(child);
+	const p = pathNormalize(parent);
+	if (c === p) return true;
+	return c.startsWith(p.endsWith(pathSep) ? p : p + pathSep);
+}
+
+export interface StackPathValidation {
+	ok: boolean;
+	error?: string;
+	resolved?: string;
+}
+
+/**
+ * Validate that a custom compose or env file path is writable by this code
+ * path. A path is accepted when it lives inside getStacksDir() or any
+ * directory in the external_stack_paths allowlist (admin-controlled, set
+ * in Settings → General), its filename is one of the conventional
+ * compose/env names, and it does not contain .. segments. The parent is
+ * resolved via realpath so a symlinked component inside an allowlisted dir
+ * cannot point elsewhere.
+ *
+ * Callers that need to grandfather an existing admin-configured path should
+ * call validateStackPathWithGrandfather() instead.
+ */
+export async function validateStackPath(input: string): Promise<StackPathValidation> {
+	if (!input || typeof input !== 'string') {
+		return { ok: false, error: 'Path is required' };
+	}
+
+	const resolvedPath = resolveStackPath(input);
+
+	// Normalized form must not contain a .. segment.
+	const segments = pathNormalize(resolvedPath).split(pathSep);
+	if (segments.includes('..')) {
+		return { ok: false, error: 'Path traversal not allowed' };
+	}
+
+	const filename = basename(resolvedPath);
+	if (!ALLOWED_STACK_FILENAMES.has(filename)) {
+		return {
+			ok: false,
+			error: `File "${filename}" is not an allowed stack filename (expected one of: ${[...ALLOWED_STACK_FILENAMES].join(', ')})`
+		};
+	}
+
+	const stacksDir = getStacksDir();
+	if (isInside(resolvedPath, stacksDir)) {
+		return { ok: true, resolved: resolvedPath };
+	}
+
+	const allowlist = await getExternalStackPaths();
+	for (const dir of allowlist) {
+		if (!dir) continue;
+		const dirResolved = resolve(dir);
+		if (isInside(resolvedPath, dirResolved)) {
+			return { ok: true, resolved: resolvedPath };
+		}
+	}
+
+	return {
+		ok: false,
+		error: `Path "${resolvedPath}" is not inside an allowed stack directory. Add its parent directory in Settings → General → External stack paths.`
+	};
+}
+
+/**
+ * Same as validateStackPath, but when the path comes from an existing
+ * stack source row (a stored custom path the admin set previously) and
+ * fails the allowlist check, add its parent dir to external_stack_paths
+ * and re-validate. Lets old custom-path configurations keep working
+ * without operator intervention.
+ */
+export async function validateStackPathWithGrandfather(
+	input: string,
+	isPreExisting: boolean
+): Promise<StackPathValidation> {
+	const first = await validateStackPath(input);
+	if (first.ok || !isPreExisting) return first;
+
+	const parent = dirname(resolveStackPath(input));
+	const added = await addExternalStackPath(parent);
+	if (added) {
+		console.log(`[Stack] Grandfathered pre-existing custom path: ${parent}`);
+	}
+	return validateStackPath(input);
+}
+
 /**
  * Find stack directory, checking paths in order:
  * 1. Database: Custom composePath in stackSources table (adopted/imported stacks)
@@ -554,6 +675,31 @@ export async function saveStackComposeFile(
 	const source = await getStackSource(name, envId);
 	const composePath = options?.composePath || source?.composePath;
 
+	// Path-allowlist validation. Pre-existing stored paths grandfather into
+	// the allowlist; new caller-supplied paths must already be inside it.
+	// See validateStackPath() docs.
+	if (composePath) {
+		const fromDb = !options?.composePath && !!source?.composePath;
+		const v = await validateStackPathWithGrandfather(composePath, fromDb);
+		if (!v.ok) return { success: false, error: v.error };
+	}
+	if (options?.envPath) {
+		const v = await validateStackPath(options.envPath);
+		if (!v.ok) return { success: false, error: v.error };
+	} else if (source?.envPath && !options?.envPath) {
+		// Grandfather a DB-stored env path that may have been configured before validation.
+		const v = await validateStackPathWithGrandfather(source.envPath, true);
+		if (!v.ok) return { success: false, error: v.error };
+	}
+	if (options?.oldComposePath) {
+		const v = await validateStackPathWithGrandfather(options.oldComposePath, true);
+		if (!v.ok) return { success: false, error: v.error };
+	}
+	if (options?.oldEnvPath) {
+		const v = await validateStackPathWithGrandfather(options.oldEnvPath, true);
+		if (!v.ok) return { success: false, error: v.error };
+	}
+
 	// Handle compose file move/rename when path changes
 	if (options?.oldComposePath && options?.composePath &&
 		options.oldComposePath !== options.composePath &&
@@ -2700,6 +2846,10 @@ export async function writeStackEnvFile(
 	envId?: number | null,
 	customEnvPath?: string
 ): Promise<void> {
+	if (customEnvPath) {
+		const v = await validateStackPath(customEnvPath);
+		if (!v.ok) throw new Error(v.error || 'Invalid env path');
+	}
 	let envFilePath: string;
 	if (customEnvPath) {
 		envFilePath = customEnvPath;
@@ -2745,6 +2895,10 @@ export async function writeRawStackEnvFile(
 	envId?: number | null,
 	customEnvPath?: string
 ): Promise<void> {
+	if (customEnvPath) {
+		const v = await validateStackPath(customEnvPath);
+		if (!v.ok) throw new Error(v.error || 'Invalid env path');
+	}
 	let envFilePath: string;
 	if (customEnvPath) {
 		envFilePath = customEnvPath;