Skip to content

Commit 3e126b2

Browse files
rudderstack-github-actions[bot]maheshkuttymihir20atzoum
authored
chore: sync release v1.81.4 to main branch (#7229)
# Description Syncing patch release v1.81.4 to main branch **↓↓ Please review and edit commit overrides before merging ↓↓** BEGIN_COMMIT_OVERRIDE fix: gcs manager allows non-service account credentials and warehouse ssl keys can escape their containing path (#7227) END_COMMIT_OVERRIDE --------- Co-authored-by: Mahesh Kutty <39219085+maheshkutty@users.noreply.github.com> Co-authored-by: rudderstack-github-actions[bot] <236995729+rudderstack-github-actions[bot]@users.noreply.github.com> Co-authored-by: Mihir Gandhi <mihir20121997@gmail.com> Co-authored-by: Aris Tzoumas <atzoum@gmail.com> Co-authored-by: Aris Tzoumas <atzoumas@rudderstack.com>
1 parent 1d772a1 commit 3e126b2

7 files changed

Lines changed: 40 additions & 12 deletions

File tree

‎CHANGELOG.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## [1.81.4](https://github.com/rudderlabs/rudder-server/compare/v1.81.3...v1.81.4) (2026-07-28)
4+
5+
6+
### Bug Fixes
7+
8+
* gcs manager allows non-service account credentials and warehouse ssl keys can escape their containing path ([#7227](https://github.com/rudderlabs/rudder-server/issues/7227)) ([9d1b171](https://github.com/rudderlabs/rudder-server/commit/9d1b171a1a5f522eff357cec2df003fe5ca9017b))
9+
310
## [1.81.3](https://github.com/rudderlabs/rudder-server/compare/v1.81.2...v1.81.3) (2026-07-27)
411

512

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
# syntax=docker/dockerfile:1
33

44
# GO_VERSION is updated automatically to match go.mod, see Makefile
5-
ARG GO_VERSION=1.26.4
6-
ARG GO_VERSION_SHA256=sha256:18b460dd17542c2ba43299a633cf6ebfc1115101509531471d7cfce1019af083
5+
ARG GO_VERSION=1.26.5
6+
ARG GO_VERSION_SHA256=sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc
77
ARG ALPINE_VERSION=3.23
88
ARG ALPINE_VERSION_SHA256=sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
99
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION}@${GO_VERSION_SHA256} AS builder

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/rudderlabs/rudder-server
22

3-
go 1.26.4
3+
go 1.26.5
44

55
// Addressing snyk vulnerabilities in indirect dependencies
66
// When upgrading a dependency, please make sure that
@@ -87,7 +87,7 @@ require (
8787
github.com/rudderlabs/bing-ads-go-sdk v0.2.3
8888
github.com/rudderlabs/compose-test v0.1.5
8989
github.com/rudderlabs/keydb v1.4.1
90-
github.com/rudderlabs/rudder-go-kit v0.78.0
90+
github.com/rudderlabs/rudder-go-kit v0.78.1
9191
github.com/rudderlabs/rudder-observability-kit v0.0.7
9292
github.com/rudderlabs/rudder-schemas v0.12.0
9393
github.com/rudderlabs/rudder-transformer/go v1.141.4
@@ -122,7 +122,7 @@ require (
122122
golang.org/x/time v0.15.0
123123
google.golang.org/api v0.287.1
124124
google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7
125-
google.golang.org/grpc v1.82.0
125+
google.golang.org/grpc v1.82.1
126126
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af
127127
k8s.io/api v0.36.2
128128
k8s.io/apimachinery v0.36.2

‎go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1129,8 +1129,8 @@ github.com/rudderlabs/keydb v1.4.1 h1:siT3oHhZ4OLKUam6j7Y9mwMVWJzn0pQqggjHMSM7Oo
11291129
github.com/rudderlabs/keydb v1.4.1/go.mod h1:umU+ZD3zTXzhBjBvMHpg96D3WIDocxzVLdV+Mj8b3pw=
11301130
github.com/rudderlabs/parquet-go v0.0.3 h1:/zgRj929pGKHsthc0kw8stVEcFu1JUcpxDRlhxjSLic=
11311131
github.com/rudderlabs/parquet-go v0.0.3/go.mod h1:WmwBOdvwpXl2aZGRk3NxxgzC/DaWGfax3jrCRhKhtSo=
1132-
github.com/rudderlabs/rudder-go-kit v0.78.0 h1:TKXf7Kn81VDQh2YjE5T97GsSRBql5noGYd908Uxkg2Y=
1133-
github.com/rudderlabs/rudder-go-kit v0.78.0/go.mod h1:yoesfaiqAlJSXKbqZvK+6ohYzKBUVPV1T4yIl3Jq78M=
1132+
github.com/rudderlabs/rudder-go-kit v0.78.1 h1:Kc8dXD/SsVOv9+1dScNwQhhUS5ri16oTs88UR4vJ+9Q=
1133+
github.com/rudderlabs/rudder-go-kit v0.78.1/go.mod h1:UAndMSV22v84OYL4xoFMB1RMI9lQjPUGCF8iK968Dfk=
11341134
github.com/rudderlabs/rudder-observability-kit v0.0.7 h1:vnIkOpcF7GRXytytls7ISfEJLNA14YE9qcoWvv5OGCo=
11351135
github.com/rudderlabs/rudder-observability-kit v0.0.7/go.mod h1:VnydP2BRF1WXrWsbcfL09fC/+Tx/ZYSt3eBB/Yj3wqc=
11361136
github.com/rudderlabs/rudder-schemas v0.12.0 h1:INUfeJdCe8BSEjC9FJkW3X47k/KN9RnutaQMpEWLG9E=
@@ -1946,8 +1946,8 @@ google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9K
19461946
google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
19471947
google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
19481948
google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
1949-
google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
1950-
google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
1949+
google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
1950+
google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
19511951
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
19521952
google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
19531953
google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

‎suppression-backup-service/Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
# syntax=docker/dockerfile:1
22

33
# GO_VERSION is updated automatically to match go.mod, see Makefile
4-
ARG GO_VERSION=1.26.4
5-
ARG GO_VERSION_SHA256=sha256:18b460dd17542c2ba43299a633cf6ebfc1115101509531471d7cfce1019af083
4+
ARG GO_VERSION=1.26.5
5+
ARG GO_VERSION_SHA256=sha256:622e56dbc11a8cfe87cafa2331e9a201877271cbff918af53d3be315f3da88cc
66

77
ARG ALPINE_VERSION=3.23
88
ARG ALPINE_VERSION_SHA256=sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11

‎warehouse/utils/utils.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import (
1010
"fmt"
1111
"net/url"
1212
"os"
13+
"path/filepath"
1314
"reflect"
1415
"regexp"
1516
"slices"
@@ -784,7 +785,11 @@ func WriteSSLKeys(destination backendconfig.DestinationT) WriteSSLKeyError {
784785
clientKey := FormatPemContent(clientKeyConfig.(string))
785786
clientCert := FormatPemContent(clientCertConfig.(string))
786787
serverCert := FormatPemContent(serverCAConfig.(string))
787-
sslDirPath := fmt.Sprintf("%s/dest-ssls/%s", directoryName, destination.ID)
788+
sslRootDir := filepath.Join(directoryName, "dest-ssls")
789+
sslDirPath := filepath.Join(sslRootDir, destination.ID)
790+
if sslDirPath != sslRootDir && !strings.HasPrefix(sslDirPath, sslRootDir+string(os.PathSeparator)) {
791+
return WriteSSLKeyError{fmt.Sprintf("Error extracting ssl information; invalid destination ID %s", destination.ID), "invalid_destination_id"}
792+
}
788793
if err = os.MkdirAll(sslDirPath, 0o700); err != nil {
789794
return WriteSSLKeyError{fmt.Sprintf("Error creating SSL root directory for destination %s %v", destination.ID, err), "dest_ssl_create_err"}
790795
}

‎warehouse/utils/utils_test.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/json"
66
"fmt"
77
"os"
8+
"path/filepath"
89
"reflect"
910
"regexp"
1011
"sort"
@@ -1265,6 +1266,21 @@ var _ = Describe("Utils", func() {
12651266

12661267
Expect(os.RemoveAll(path)).NotTo(HaveOccurred())
12671268
})
1269+
1270+
It("SSL keys with path traversal destination ID", func() {
1271+
clientKey, clientCert, serverCA := misc.FastUUID().String(), misc.FastUUID().String(), misc.FastUUID().String()
1272+
1273+
tmpDir, tmpDirErr := misc.GetTmpDir()
1274+
Expect(tmpDirErr).NotTo(HaveOccurred())
1275+
escapedPath := filepath.Join(tmpDir, "escaped-destID")
1276+
defer os.RemoveAll(escapedPath)
1277+
1278+
destinationID := "../escaped-destID"
1279+
err := WriteSSLKeys(backendconfig.DestinationT{ID: destinationID, Config: map[string]any{"clientKey": clientKey, "clientCert": clientCert, "serverCA": serverCA}})
1280+
Expect(err.GetErrTag()).To(Equal("invalid_destination_id"))
1281+
1282+
Expect(escapedPath).NotTo(BeADirectory())
1283+
})
12681284
})
12691285

12701286
func TestMain(m *testing.M) {

0 commit comments

Comments
 (0)