Gecko [ tanishkshah.com ]

Name	Size	Permission	Date	Action
SafeFile.pm	2.48 KB	-rw-r--r--	2026-08-11 11:38

Rename

# Copyright © Cloud Linux GmbH & Cloud Linux Software, Inc 2010-2026 All Rights Reserved
#
# Licensed under CLOUD LINUX LICENSE AGREEMENT
# http://cloudlinux.com/docs/LICENSE.TXT
package CloudLinux::SafeFile;

use strict;
use warnings;

use Fcntl qw(O_RDONLY O_NOFOLLOW);
use Exporter qw(import);

our @EXPORT_OK = qw(safe_open_in);

# safe_open_in($filename, \@allowed_dirs)
#
# Opens $filename read-only and returns ($fh, $resolved_path) iff the inode
# the fd points to lives under one of @allowed_dirs (each entry MUST end in
# '/' so prefix matching cannot span directory boundaries, e.g. '/var/log'
# must not accept '/var/log-evil/...'). On rejection or failure, returns
# (undef, $error_message) with no fd leaked.
#
# Why validate AFTER opening rather than before:
#
# A "canonicalise the path, check it, then open it" approach is vulnerable
# to TOCTOU. An attacker with write access to any intermediate directory
# under the allowlist can swap a component (or replace it with a symlink)
# between the check and the open, redirecting us to read e.g. /etc/shadow
# as root. abs_path() + a prefix check does not close this race -- it only
# tells us what the path resolved to AT CHECK TIME, not what open() will
# resolve when it runs a moment later.
#
# Once we hold an fd, the kernel has already committed to a specific inode.
# readlink("/proc/self/fd/N") reports the kernel's resolved absolute path
# for that inode -- nothing the attacker does after open() can change what
# the fd actually references. Validating the resolved path of an open fd is
# therefore race-free.
#
# O_NOFOLLOW additionally refuses a symlink as the FINAL path component
# (intermediate symlinks are still followed during open() -- O_NOFOLLOW
# only inspects the last component). The post-open /proc-fd check would
# catch a symlink-to-outside-allowlist anyway, but failing fast on the
# open is cheaper and clearer about intent.
sub safe_open_in {
    my ($filename, $allowed_dirs_ref) = @_;

sysopen(my $fh, $filename, O_RDONLY | O_NOFOLLOW)
        or return (undef, "File $filename is not available for reading");

my $resolved = readlink("/proc/self/fd/" . fileno($fh));
    if (!defined $resolved) {
        close($fh);
        return (undef, "Cannot resolve real path for $filename");
    }

for my $dir (@$allowed_dirs_ref) {
        if (substr($resolved, 0, length($dir)) eq $dir) {
            return ($fh, $resolved);
        }
    }
    close($fh);
    return (undef, "File path is not within allowed directories");
}