fix: validate build cache keys

Author: TorstenDittmann

src/Executor/Runner/Docker.php

@@ -256,6 +256,7 @@ public function createRuntime(
         /** @var array<string, mixed> $container */
         $container = [];
         $output = [];
+        $cacheWarnings = [];
         $startTime = \microtime(true);
 
         $runtime = new Runtime(
@@ -329,8 +330,9 @@ public function createRuntime(
             ];
 
             $cacheEnabled = $cacheKey !== '' && $command !== '' && $command !== '0';
-            $cacheWarnings = [];
             if ($cacheEnabled) {
+                $this->validateBuildCacheKey($cacheKey);
+
                 try {
                     $this->restoreBuildCacheArtifact($cacheKey, $tmpCache, $localDevice);
                 } catch (Throwable $err) {
@@ -487,6 +489,10 @@ public function createRuntime(
                 ]];
             }
 
+            if ($cacheWarnings !== []) {
+                $output = \array_merge($cacheWarnings, $output);
+            }
+
             if ($remove) {
                 \sleep(2); // Allow time to read logs
             }
@@ -561,6 +567,18 @@ private function getBuildCacheWarning(string $message): array
         ];
     }
 
+    private function validateBuildCacheKey(string $cacheKey): void
+    {
+        if (
+            \str_contains($cacheKey, "\0") ||
+            \str_starts_with($cacheKey, '/') ||
+            \str_contains($cacheKey, '\\') ||
+            \preg_match('#(^|/)\.\.(?:/|$)#', $cacheKey) === 1
+        ) {
+            throw new \Exception('Invalid build cache key', 400);
+        }
+    }
+
     private function restoreBuildCacheArtifact(string $cacheKey, string $tmpCache, Local $localDevice): void
     {
         if (!$localDevice->createDirectory($tmpCache)) {

tests/unit/Executor/Runner/DockerTest.php

@@ -44,6 +44,15 @@ public function testNoCacheLifecycleShellCommandsAreGenerated(): void
         $this->assertStringNotContainsString('build-cache-save.sh', $command);
     }
 
+    public function testInvalidBuildCacheKeyIsRejected(): void
+    {
+        $this->expectException(\Exception::class);
+        $this->expectExceptionCode(400);
+
+        $method = new ReflectionMethod(Docker::class, 'validateBuildCacheKey');
+        $method->invoke($this->createDocker(), '..');
+    }
+
     /**
      * @return string[]
      */