f81e839ba2
- validate instance names at the host lib and web boundary against
[a-z0-9][a-z0-9_-]{0,63} to prevent path traversal via Server.name
- fail-closed on SECRET_KEY: load_config returns None when env unset,
create_app raises if missing or "dev" outside TESTING
- close login timing oracle by hashing a dummy digest when the user
is not found, equalizing response time
- set SESSION_COOKIE_SECURE outside TESTING
- delete_instance tolerates stop_service and fusermount3 failures so
partially-initialized instances clean up without contract breaks;
drops the is_mount() preflight that violated AGENTS.md
- document claim_next_job's single-process assumption
- clarify emit_step contract via docstring
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
63 lines
2 KiB
Python
63 lines
2 KiB
Python
import os
|
|
import re
|
|
from pathlib import Path
|
|
|
|
|
|
_INSTANCE_NAME_RE = re.compile(r"^[a-z0-9][a-z0-9_-]{0,63}$")
|
|
|
|
|
|
DEFAULT_LEFT4ME_ROOT = Path("/var/lib/left4me")
|
|
|
|
|
|
def get_left4me_root() -> Path:
|
|
raw = os.environ.get("LEFT4ME_ROOT")
|
|
if raw is None:
|
|
return DEFAULT_LEFT4ME_ROOT
|
|
root = raw.strip()
|
|
if not root:
|
|
raise ValueError("LEFT4ME_ROOT must not be empty")
|
|
if root != raw:
|
|
raise ValueError("LEFT4ME_ROOT must not contain leading or trailing whitespace")
|
|
path = Path(root)
|
|
if not path.is_absolute():
|
|
raise ValueError("LEFT4ME_ROOT must be absolute")
|
|
return path
|
|
|
|
|
|
def validate_instance_name(name: str) -> str:
|
|
if not _INSTANCE_NAME_RE.fullmatch(name):
|
|
raise ValueError(
|
|
"instance name must match [a-z0-9][a-z0-9_-]{0,63} "
|
|
"(lowercase, no path separators, no whitespace)"
|
|
)
|
|
return name
|
|
|
|
|
|
def validate_overlay_ref(ref: str) -> str:
|
|
stripped = ref.strip()
|
|
if stripped != ref:
|
|
raise ValueError("overlay ref must not contain leading or trailing whitespace")
|
|
if stripped in {"", ".", ".."}:
|
|
raise ValueError("overlay ref must not be empty or current/parent directory")
|
|
if Path(stripped).is_absolute():
|
|
raise ValueError("overlay ref must be relative")
|
|
|
|
components = stripped.split("/")
|
|
if any(component in {"", ".", ".."} for component in components):
|
|
raise ValueError("overlay ref must not contain empty, current, or parent components")
|
|
|
|
return stripped
|
|
|
|
|
|
def overlay_path(ref: str, *, root: Path | None = None) -> Path:
|
|
safe_ref = validate_overlay_ref(ref)
|
|
left4me_root = get_left4me_root() if root is None else Path(root)
|
|
overlays_root = left4me_root / "overlays"
|
|
candidate = overlays_root / safe_ref
|
|
|
|
resolved_overlays_root = overlays_root.resolve()
|
|
resolved_candidate = candidate.resolve()
|
|
if resolved_candidate != resolved_overlays_root and resolved_overlays_root not in resolved_candidate.parents:
|
|
raise ValueError("overlay path escapes overlay root")
|
|
|
|
return candidate
|