Beagle SCM

JS-065 CRIT: path-traversal / arbitrary write on checkout

A malicious git tree drives be get/be patch to write or unlink files OUTSIDE the worktree. Tree-entry names flow byte-for-byte into io.open(..,"c")/io.symlink/io.unlink with no ../absolute /empty-segment rejection, and ingest runs no fsck. One central guard in GET/PATCH's shared write sink closes it. Method: Issues.

Input

Context

• shared/store.js:505 builds each leaf path as

  prefix + "/" + e.name — e.name is raw git tree-entry bytes.

• shared/util/path.js:25-27 join is pure concat: dir+"/"+name.
• shared/checkout.js:95-104 materialise opens join(wtRoot,rel)

  via io.open(full,"c") / io.symlink with NO name check.

• verbs/get/get.js:342 get-leaf → checkout.materialise(g.wt,rel..).
• verbs/get/get.js:328 delete-leaf → io.unlink(join(g.wt,rel)).
• verbs/patch/patch.js:316 theirs-side → same checkout.materialise.
• verbs/patch/patch.js:320 deleteLeaf → io.unlink(join(wtRoot,..)).
• A tree entry named .. escapes the wt; ../../.ssh/authorized_keys

  is writable; ingest (shared/ingest.js) does NO fsck/name validation.

• shared/stage.js:51-55 isMeta blocks .git/.be/..be.idx

  segments but NOT .. (so even staging would not catch it).

Goals

• Reject any rel with a ""/./.. segment or an absolute leading /.
• Reject NUL and reserved names before any fs write/unlink.
• Make the malicious-tree repro test FAIL to escape and pass clean.

Constraints

• ONE central guard, no per-call-site copies; parity with C keeper/WALK.
• Enforce in checkout.materialise (covers get+patch file leaves) AND

  at the producer store.js::readTreeRecursive (covers delete leaves).

• Extend stage.js::isMeta to also reject the .. segment.

WIP

Design decisions

• Guard signature safeRel(rel) -> bool: /-split, scan segments.
• Producer-side throw in readTreeRecursive stops poisoned deletes too,

  since delete leaves bypass materialise (io.unlink direct).

• materialise guard is the belt-and-braces sink for both verbs.

TODOs

• Repro-first: craft a tree with a .. entry; assert be get

  writes nothing outside wt and errors (test/js/get/traversal).

• Add safeRel (one place) + wire into materialise + producer.
• Extend isMeta to reject ..; assert stage rejects it.

Blockers and bummers

• None; self-contained guard.

Outcome

• LANDED: be f9180c2e + be/test 21d8ca90 (be-js-get-traversal).
• Root cause CONFIRMED: a tree subentry named .. holding evil.txt

  flattens to leaf path ../evil.txt; unpatched jab get wrote PWNED into $WORK/evil.txt OUTSIDE the wt; a delete leaf ../victim.txt io.unlinked an outside-wt sentinel.

• safeRel(rel) added in ONE place: shared/util/path.js (split on

  /, reject `/./../.git/.be/..be.idx seg, leading /`, NUL).

• Wired 3 sinks: checkout.js::materialise (get+patch file writes),

  store.js::readTreeRecursive producer throw (patch full-tree map → covers its write+delete leaves; checkout.apply delete loop), and stage.js::isMeta now also rejects a .. segment.

• Test be/test/get/traversal/run.sh (be-js-get-traversal, glob-

  picked, no CMakeLists edit): malicious get ERRORS + writes/unlinks nothing above wt + clean sibling tree still checks out.

• RED (guards stripped): test FAILs "malicious get SUCCEEDED".

  GREEN (guards in): passes; jab errors "checkout: unsafe path ../evil.txt". Full be/ ctest 74/74 green (sole red is the pre-existing stale be-js-bro-universal WILL_FAIL xfail).