[release-7.4] BulkLoad: reject path-traversal in manifest file paths by ShreeChaturvedi · Pull Request #14334 · apple/foundationdb

ShreeChaturvedi · 2026-10-20T21:59:25Z

Backport of #13665 to release-7.4. release-8.0 already contains it.

A crafted bulk-load manifest could set [RelativePath], [DataFileName], or [ByteSampleFileName] to an absolute path or one containing .., driving resetFileFolder() → eraseDirectoryRecursive() and file writes outside the storage server's local staging root. The fix rejects such fields in BulkLoadFileSet::isValid() and adds a containment check right before the staging folder is reset in both the CP and blobstore transport paths.

The BulkLoading.h change applied cleanly. The fdbserver/core/BulkLoadUtil.cpp hunk conflicted only because release-7.4 has this code in fdbserver/BulkLoadUtil.actor.cpp; the same code was applied there, with the flow/UnitTest.h include placed before actorcompiler.h. No functional differences from main.

Validation:

fdbserver builds (clang, USE_WERROR=ON).
fdbserver -r unittests -f /fdbserver/BulkLoad/bulkLoadPathIsContained passes.
tests/fast/BulkLoading.toml and tests/fast/BulkDumping.toml pass; no SevError, and the new guard never fires on normal jobs.
Joshua: 20261020-222819-shreechaturvedi-cb016c5149db79d4: 100,000/100,000 passed, 0 failed.

…pple#13665) * BulkLoad: reject path-traversal in manifest file paths A crafted bulk-load manifest could set [RelativePath], [DataFileName], or [ByteSampleFileName] to an absolute path or one containing ".." components. getFolder() joins these onto the local staging root and the result flows into abspath() -> eraseDirectoryRecursive() (and subsequent file writes), so a manifest such as "[RelativePath]: ../../../../var/lib/foundationdb" could make every storage server running the job wipe and overwrite an arbitrary directory (e.g. the FDB data directory or TLS material). Add two layers of validation: - Parse/construction time: BulkLoadFileSet::isValid() now rejects relativePath, manifestFileName, dataFileName, and byteSampleFileName that are absolute or contain a ".." component (bulkLoadPathIsContained). Bad manifests are refused before any local path is constructed. - Sink guard: assertLocalFolderContained() verifies the resolved staging folder is at or under the resolved local root immediately before resetFileFolder(), in both bulkLoadTransportCP_impl and bulkLoadTransportBlobstore_impl. Add unit test /fdbserver/BulkLoad/bulkLoadPathIsContained. * Formatting * BulkLoad: use std::string::starts_with in containment check Address review feedback: C++20 starts_with() is clearer than the size()+compare() prefix check. (cherry picked from commit 8f09b3c)

spraza · 2026-10-26T17:41:51Z

Change looks isolated to bulk load, so ok for 7.4 backport. Accepting.

@ShreeChaturvedi triggered rebase. Once CI is clear, feel free to merge.

ploxiln · 2026-10-28T01:57:06Z

fdbserver -r simulation --crash --logsize 1024MB -f src/foundationdb/tests/rare/ClogRemoteTLog.toml --buggify on --seed 3177335570

20261028-011744-pr14334-441b0796-17899-7b17973001945297 compressed=True data_size=60629440 duration=294310 ended=10000 fail=1 fail_fast=10 max_runs=10000 pass=9999 priority=100 remaining=0 runtime=0:10:08 sanity=False started=10000 stopped=20261028-012752 submitted=20261028-011744 timeout=5400 username=pr14334-441b0796-17899

unrelated (but noting in case it forms a pattern), will trigger rebuild/retest

foundationdb-ci · 2026-10-28T05:30:49Z

Result of foundationdb-pr-macos-m1 on macOS 14.x

Commit ID: 80580f4
Duration 0:35:16
Result: ✅ SUCCEEDED
Error: N/A
Build Log terminal output (available for 30 days)
Build Workspace zip file of the working directory (available for 30 days)

foundationdb-ci · 2026-10-28T05:32:49Z

Result of foundationdb-pr-clang on Linux RHEL 9

Commit ID: 80580f4
Duration 0:37:13
Result: ✅ SUCCEEDED
Error: N/A
Build Log terminal output (available for 30 days)
Build Workspace zip file of the working directory (available for 30 days)

foundationdb-ci · 2026-10-28T05:39:15Z

Result of foundationdb-pr-clang-arm on Linux RHEL 9

Commit ID: 80580f4
Duration 0:43:39
Result: ✅ SUCCEEDED
Error: N/A
Build Log terminal output (available for 30 days)
Build Workspace zip file of the working directory (available for 30 days)

foundationdb-ci · 2026-10-28T05:47:32Z

Result of foundationdb-pr on Linux RHEL 9

Commit ID: 80580f4
Duration 0:51:58
Result: ✅ SUCCEEDED
Error: N/A
Build Log terminal output (available for 30 days)
Build Workspace zip file of the working directory (available for 30 days)

foundationdb-ci · 2026-10-28T06:41:47Z

Result of foundationdb-pr-cluster-tests on Linux RHEL 9

Commit ID: 80580f4
Duration 1:46:12
Result: ✅ SUCCEEDED
Error: N/A
Build Log terminal output (available for 30 days)
Build Workspace zip file of the working directory (available for 30 days)
Cluster Test Logs zip file of the test logs (available for 30 days)

foundationdb-ci · 2026-10-28T18:28:59Z