fix: prevent path traversal in saveParameter and saveArtifact

Add bounds check before writing output parameter/artifact files so that
relative paths like ../../ctr/containerB/exitcode cannot escape the
/var/run/argo/outputs/ subtree.

Fixes GHSA-r9w2-rp4m-gwr9

Signed-off-by: Jayant Kamble <jayantkamble10000@google.com>
Signed-off-by: Jayant Kamble <jayantkamble10000@gmail.com>

Author: jayantkamble10000

cmd/argoexec/commands/emissary.go

@@ -401,11 +401,15 @@ func saveArtifact(ctx context.Context, srcPath string) error {
 		logger.WithField("srcPath", srcPath).Info(ctx, "no need to save artifact - on overlapping volume")
 		return nil
 	}
+	dstPath := filepath.Join(varRunArgo, "outputs/artifacts", strings.TrimSuffix(srcPath, "/")+".tgz")
+	safeArtifactBase := filepath.Clean(filepath.Join(varRunArgo, "outputs/artifacts")) + string(os.PathSeparator)
+	if !strings.HasPrefix(filepath.Clean(dstPath)+string(os.PathSeparator), safeArtifactBase) {
+		return fmt.Errorf("path traversal in output artifact path %q", srcPath)
+	}
 	if _, err := os.Stat(srcPath); os.IsNotExist(err) { // might be optional, so we ignore
 		logger.WithField("srcPath", srcPath).WithError(err).Warn(ctx, "cannot save artifact")
 		return nil
 	}
-	dstPath := filepath.Join(varRunArgo, "/outputs/artifacts/", strings.TrimSuffix(srcPath, "/")+".tgz")
 	logger.WithFields(logging.Fields{
 		"src": srcPath,
 		"dst": dstPath,
@@ -435,6 +439,11 @@ func saveParameter(ctx context.Context, srcPath string) error {
 		logger.WithField("src", srcPath).Info(ctx, "no need to save parameter - on overlapping volume")
 		return nil
 	}
+	dstPath := filepath.Join(varRunArgo, "outputs/parameters", srcPath)
+	safeParamBase := filepath.Clean(filepath.Join(varRunArgo, "outputs/parameters")) + string(os.PathSeparator)
+	if !strings.HasPrefix(filepath.Clean(dstPath)+string(os.PathSeparator), safeParamBase) {
+		return fmt.Errorf("path traversal in output parameter path %q", srcPath)
+	}
 	src, err := os.Open(filepath.Clean(srcPath))
 	if os.IsNotExist(err) { // might be optional, so we ignore
 		logger.WithField("src", srcPath).WithError(err).Error(ctx, "cannot save parameter, does not exist")
@@ -444,7 +453,6 @@ func saveParameter(ctx context.Context, srcPath string) error {
 		return fmt.Errorf("failed to open %s: %w", srcPath, err)
 	}
 	defer func() { _ = src.Close() }()
-	dstPath := varRunArgo + "/outputs/parameters/" + srcPath
 	logger.WithFields(logging.Fields{
 		"src": srcPath,
 		"dst": dstPath,

cmd/argoexec/commands/emissary_test.go

@@ -5,6 +5,7 @@ package commands
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"strconv"
 	"sync"
 	"syscall"
@@ -205,6 +206,52 @@ func TestEmissary(t *testing.T) {
 	})
 }
 
+func TestSaveParameterPathTraversal(t *testing.T) {
+	tmp := t.TempDir()
+	varRunArgo = tmp
+	ctx := logging.TestContext(t.Context())
+
+	srcFile := filepath.Join(tmp, "result.txt")
+	require.NoError(t, os.WriteFile(srcFile, []byte("hello"), 0o644))
+
+	t.Run("LegitimateAbsolutePath", func(t *testing.T) {
+		err := saveParameter(ctx, srcFile)
+		require.NoError(t, err)
+	})
+	t.Run("TraversalToArgoexec", func(t *testing.T) {
+		err := saveParameter(ctx, "../../argoexec")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "path traversal")
+	})
+	t.Run("TraversalToSidecarExitCode", func(t *testing.T) {
+		err := saveParameter(ctx, "../../ctr/sidecar/exitcode")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "path traversal")
+	})
+	t.Run("TraversalToTemplate", func(t *testing.T) {
+		err := saveParameter(ctx, "../template")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "path traversal")
+	})
+}
+
+func TestSaveArtifactPathTraversal(t *testing.T) {
+	tmp := t.TempDir()
+	varRunArgo = tmp
+	ctx := logging.TestContext(t.Context())
+
+	t.Run("TraversalToArgoexec", func(t *testing.T) {
+		err := saveArtifact(ctx, "../../argoexec")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "path traversal")
+	})
+	t.Run("TraversalToSidecarExitCode", func(t *testing.T) {
+		err := saveArtifact(ctx, "../../ctr/sidecar/exitcode")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "path traversal")
+	})
+}
+
 func run(script string) error {
 	cmd := NewEmissaryCommand()
 	_, _, err := cmdutil.ContextWithLogger(cmd, string(logging.Info), string(logging.Text))