feat: support STORAGE_PATH_PREFIX for global storage key namespacing#697
feat: support STORAGE_PATH_PREFIX for global storage key namespacing#697
Conversation
Add StoragePathPrefix config field. Prepend prefix to media, installed, package, and persistence storage paths via path.Join. Include segment-based path traversal validation rejecting '..' segments.
dosubot
Bot
added
size:M
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a STORAGE_PATH_PREFIX configuration to globally prefix storage paths for persistence and plugin management. The feedback highlights that the validation logic for this prefix is duplicated across multiple files and could be bypassed if the sub-paths themselves contain '..' segments. It is recommended to centralize the validation logic and ensure the final joined paths are validated to prevent potential path traversal issues.
| if prefix := strings.Trim(config.StoragePathPrefix, "/"); prefix != "" { | ||
| for _, seg := range strings.Split(prefix, "/") { | ||
| if seg == ".." { | ||
| log.Panic("STORAGE_PATH_PREFIX must not contain '..'") | ||
| } | ||
| } | ||
| storagePath = path.Join(prefix, storagePath) | ||
| } |
There was a problem hiding this comment.
The validation logic for STORAGE_PATH_PREFIX is duplicated here and in internal/core/plugin_manager/manager.go. Additionally, the current check only prevents .. in the prefix itself. If config.PersistenceStoragePath contains .. segments, it could still escape the intended namespace. It is safer to validate the final joined path to ensure it remains within the prefix boundaries.
| joinPrefix := func(p string) string { | ||
| if prefix == "" { | ||
| return p | ||
| } | ||
| return path.Join(prefix, p) | ||
| } |
There was a problem hiding this comment.
The joinPrefix helper should ensure that the resulting path does not escape the configured prefix. If the input path p contains .. segments, path.Join might resolve it to a location outside of the prefix. Validating the joined path against the prefix is a more robust approach.
1 participant
Description
Add global
STORAGE_PATH_PREFIXsupport to namespace all object storage keys under a configurable path prefix, enabling multi-tenant or environment-separated deployments sharing a single bucket.resolve ENG-44
Type of Change
Essential Checklist
Testing
Bug Fix (if applicable)
Fixes #123orCloses #123)Additional Information
StoragePathPrefixconfig field (STORAGE_PATH_PREFIXenv var)path.Join..segments