|
| 1 | +# SPDX-FileCopyrightText: NVIDIA CORPORATION & AFFILIATES |
| 2 | +# Copyright (c) 2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved. |
| 3 | +# SPDX-License-Identifier: Apache-2.0 |
| 4 | +# |
| 5 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 6 | +# you may not use this file except in compliance with the License. |
| 7 | +# You may obtain a copy of the License at |
| 8 | +# |
| 9 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 10 | +# |
| 11 | +# Unless required by applicable law or agreed to in writing, software |
| 12 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 13 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 14 | +# See the License for the specific language governing permissions and |
| 15 | +# limitations under the License. |
| 16 | + |
| 17 | +""" |
| 18 | +OS utilities for safe file operations. |
| 19 | +
|
| 20 | +This module provides os utilities to prevent symlink attacks and ensure |
| 21 | +safe file operations. |
| 22 | +""" |
| 23 | + |
| 24 | +import os |
| 25 | +import stat |
| 26 | + |
| 27 | + |
| 28 | +def validate_directory(dir_path: str) -> None: |
| 29 | + """ |
| 30 | + Validate that a directory is safe for file operations. |
| 31 | +
|
| 32 | + This function performs comprehensive security checks to ensure the directory |
| 33 | + is safe from symlink attacks and has appropriate permissions. |
| 34 | +
|
| 35 | + Args: |
| 36 | + dir_path: Path to the directory to validate |
| 37 | +
|
| 38 | + Raises: |
| 39 | + OSError: If the directory is unsafe or inaccessible |
| 40 | + """ |
| 41 | + if not os.path.exists(dir_path): |
| 42 | + return |
| 43 | + |
| 44 | + # Check if it's actually a directory |
| 45 | + if not os.path.isdir(dir_path): |
| 46 | + raise OSError(f"Path is not a directory: {dir_path}") |
| 47 | + |
| 48 | + # Check if it's a symlink |
| 49 | + if os.path.islink(dir_path): |
| 50 | + raise OSError(f"Directory is a symlink: {dir_path}") |
| 51 | + |
| 52 | + # Get directory stats |
| 53 | + try: |
| 54 | + dir_stat = os.stat(dir_path) |
| 55 | + except OSError as e: |
| 56 | + raise OSError(f"Cannot access directory {dir_path}: {e}") |
| 57 | + |
| 58 | + # Check if it's a regular directory (not a special file) |
| 59 | + if not stat.S_ISDIR(dir_stat.st_mode): |
| 60 | + raise OSError(f"Path is not a regular directory: {dir_path}") |
| 61 | + |
| 62 | + # Check permissions - directory should not be world-writable unless sticky bit is set |
| 63 | + mode = dir_stat.st_mode |
| 64 | + if stat.S_IWOTH & mode: # World writable |
| 65 | + if not (stat.S_ISVTX & mode): # No sticky bit |
| 66 | + raise OSError(f"Directory is world-writable without sticky bit: {dir_path}") |
| 67 | + |
| 68 | + |
| 69 | +def validate_filepath(file_path: str) -> None: |
| 70 | + """ |
| 71 | + Validate that a file path is safe for file operations. |
| 72 | +
|
| 73 | + This function checks that the file (if it exists) is not a symlink and is a regular file. |
| 74 | +
|
| 75 | + Args: |
| 76 | + file_path: Path to the file to validate |
| 77 | +
|
| 78 | + Raises: |
| 79 | + OSError: If the file is unsafe or inaccessible |
| 80 | + """ |
| 81 | + if os.path.exists(file_path): |
| 82 | + validate_directory(os.path.dirname(file_path)) |
| 83 | + # Check if it's a symlink - this must be done every time |
| 84 | + if os.path.islink(file_path): |
| 85 | + raise OSError(f"File is a symlink: {file_path}") |
| 86 | + |
| 87 | + # Validate it's a regular file |
| 88 | + try: |
| 89 | + file_stat = os.stat(file_path) # Follow symlinks for stat |
| 90 | + if not stat.S_ISREG(file_stat.st_mode): |
| 91 | + raise OSError(f"Path is not a regular file: {file_path}") |
| 92 | + except OSError as e: |
| 93 | + raise OSError(f"Cannot access file {file_path}: {e}") |
| 94 | + # If file doesn't exist, that's fine - it will be created |
0 commit comments