mirror of
https://github.com/apple/container.git
synced 2026-09-13 19:25:47 +00:00
J Logan
3e93416b9a
* Admit only valid OCI layout files when loading image. - Adds `AdmissionMapper` protocol for validating archive member paths and normalizing them to relative paths under the extraction root directory. - Renames `Reader.swift` to `ArchiveReader.swift` to match type name. - Rework `TempDir` to address `NSString.utf8String` deprecation warning in Swift 6.2.3. - Rework `ArchiveReader.extractContent()` to use an `AdmissionMapper` to validate and remap archive members before extracting. - Adds `IdentityAdmissionWrapper` for naive extraction. - Adds `NoSymlinkAdmissionWrapper` that only extracts regular files and directories under the extraction root. - Adds `OCIImageAdmissionWrapper` that only extracts valid OCI image layout paths. - Use `OCIImageAdmissionWrapper` for `cctl image load` and print rejected paths. * PR feedback. * Adds public init() for TrustedAdmissionMapper. * Replace AdmissionMapper with more secure extraction. - Adds FileDescriptor.mkdirSecure() to prevent root escapes on member pathnames, and to prevent symlink traversal. - Adds FileDescriptor.unlinkRecursive() to facilitate overwrites when there are multiple archive entries with the same member path. - Adds FileDescriptor.validateSymlinkTargetInRoot() to validate that extracted symlink targets do not escape the root. - Rewrite ArchiveReader.extractContents() to use secure path functions. * Remove unneeded symlink check, rename files. * Simplify the lexical normalizer workaround. * Reject member paths containing parent traversal components. * Remove unused lexical normalization workaround. * Fix leaking fds, extract absolute members as relative.
223 lines
6.6 KiB
JSON
223 lines
6.6 KiB
JSON
{
|
|
"originHash" : "dcc639b6cdf875204fc0d722e0eae8f11a5b19fb8517998bd776a9b76b48c3e8",
|
|
"pins" : [
|
|
{
|
|
"identity" : "async-http-client",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/swift-server/async-http-client.git",
|
|
"state" : {
|
|
"revision" : "60235983163d040f343a489f7e2e77c1918a8bd9",
|
|
"version" : "1.26.1"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "grpc-swift",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/grpc/grpc-swift.git",
|
|
"state" : {
|
|
"revision" : "a56a157218877ef3e9625f7e1f7b2cb7e46ead1b",
|
|
"version" : "1.26.1"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-algorithms",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-algorithms.git",
|
|
"state" : {
|
|
"revision" : "87e50f483c54e6efd60e885f7f5aa946cee68023",
|
|
"version" : "1.2.1"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-argument-parser",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-argument-parser.git",
|
|
"state" : {
|
|
"revision" : "011f0c765fb46d9cac61bca19be0527e99c98c8b",
|
|
"version" : "1.5.1"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-asn1",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-asn1.git",
|
|
"state" : {
|
|
"revision" : "a54383ada6cecde007d374f58f864e29370ba5c3",
|
|
"version" : "1.3.2"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-async-algorithms",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-async-algorithms.git",
|
|
"state" : {
|
|
"revision" : "042e1c4d9d19748c9c228f8d4ebc97bb1e339b0b",
|
|
"version" : "1.0.4"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-atomics",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-atomics.git",
|
|
"state" : {
|
|
"revision" : "cd142fd2f64be2100422d658e7411e39489da985",
|
|
"version" : "1.2.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-certificates",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-certificates.git",
|
|
"state" : {
|
|
"revision" : "999fd70c7803da89f3904d635a6815a2a7cd7585",
|
|
"version" : "1.10.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-collections",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-collections.git",
|
|
"state" : {
|
|
"revision" : "c1805596154bb3a265fd91b8ac0c4433b4348fb0",
|
|
"version" : "1.2.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-crypto",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-crypto.git",
|
|
"state" : {
|
|
"revision" : "e8d6eba1fef23ae5b359c46b03f7d94be2f41fed",
|
|
"version" : "3.12.3"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-docc-plugin",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/swiftlang/swift-docc-plugin",
|
|
"state" : {
|
|
"revision" : "d1691545d53581400b1de9b0472d45eb25c19fed",
|
|
"version" : "1.4.4"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-docc-symbolkit",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/swiftlang/swift-docc-symbolkit",
|
|
"state" : {
|
|
"revision" : "b45d1f2ed151d057b54504d653e0da5552844e34",
|
|
"version" : "1.0.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-http-structured-headers",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-http-structured-headers.git",
|
|
"state" : {
|
|
"revision" : "db6eea3692638a65e2124990155cd220c2915903",
|
|
"version" : "1.3.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-http-types",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-http-types.git",
|
|
"state" : {
|
|
"revision" : "a0a57e949a8903563aba4615869310c0ebf14c03",
|
|
"version" : "1.4.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-log",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-log.git",
|
|
"state" : {
|
|
"revision" : "3d8596ed08bd13520157f0355e35caed215ffbfa",
|
|
"version" : "1.6.3"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-nio",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-nio.git",
|
|
"state" : {
|
|
"revision" : "34d486b01cd891297ac615e40d5999536a1e138d",
|
|
"version" : "2.83.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-nio-extras",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-nio-extras.git",
|
|
"state" : {
|
|
"revision" : "145db1962f4f33a4ea07a32e751d5217602eea29",
|
|
"version" : "1.28.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-nio-http2",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-nio-http2.git",
|
|
"state" : {
|
|
"revision" : "4281466512f63d1bd530e33f4aa6993ee7864be0",
|
|
"version" : "1.36.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-nio-ssl",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-nio-ssl.git",
|
|
"state" : {
|
|
"revision" : "173cc69a058623525a58ae6710e2f5727c663793",
|
|
"version" : "2.36.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-nio-transport-services",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-nio-transport-services.git",
|
|
"state" : {
|
|
"revision" : "cd1e89816d345d2523b11c55654570acd5cd4c56",
|
|
"version" : "1.24.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-numerics",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-numerics.git",
|
|
"state" : {
|
|
"revision" : "e0ec0f5f3af6f3e4d5e7a19d2af26b481acb6ba8",
|
|
"version" : "1.0.3"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-protobuf",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-protobuf.git",
|
|
"state" : {
|
|
"revision" : "102a647b573f60f73afdce5613a51d71349fe507",
|
|
"version" : "1.30.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-service-lifecycle",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/swift-server/swift-service-lifecycle.git",
|
|
"state" : {
|
|
"revision" : "e7187309187695115033536e8fc9b2eb87fd956d",
|
|
"version" : "2.8.0"
|
|
}
|
|
},
|
|
{
|
|
"identity" : "swift-system",
|
|
"kind" : "remoteSourceControl",
|
|
"location" : "https://github.com/apple/swift-system.git",
|
|
"state" : {
|
|
"revision" : "395a77f0aa927f0ff73941d7ac35f2b46d47c9db",
|
|
"version" : "1.6.3"
|
|
}
|
|
}
|
|
],
|
|
"version" : 3
|
|
}
|