Harden native static and redirect handling

eldryoth · eldryoth · commit d8f7ac7ceac9 · 2026-06-21T15:53:22.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -38,8 +38,16 @@ behavior when the change improves security or project direction.
   containment model in the native static-web route adapter.
 - Reject percent-decoded dot-segment, backslash, NUL, and denied-dotfile paths
   before static files are resolved.
-- Re-open static response bodies only after confirming the requested path is
-  still rooted under the configured web root and is still a regular file.
+- Open static response bodies with rooted component-by-component `openat`
+  calls and no-symlink flags, closing the symlink-swap window between metadata
+  checks and body reads.
+- Return `405 Method Not Allowed` from the native static-web handler for
+  methods other than `GET` and `HEAD`, even when the route method list matches
+  all methods.
+- Validate native redirect `Location` URL paths with the shared bounded
+  multi-pass forward-path safety check so encoded and double-encoded dot
+  segments or slashes cannot be introduced through `{query}`, `{path}`, or
+  `{uri}` expansion.
 - Bound native buffered static responses to 64 MiB until the final native
   streaming body path is enabled.
 - Keep forwarded-client-IP ownership shortcuts on the compatibility path while
diff --git a/crates/fluxheim-server/src/native_http1_route_proxy.rs b/crates/fluxheim-server/src/native_http1_route_proxy.rs
@@ -579,7 +579,7 @@ fn redirect_location_path_safe(location: &str) -> bool {
         .find(['?', '#'])
         .unwrap_or(path_and_tail.len());
     let path = &path_and_tail[..path_end];
-    !path.contains("//") && !path.split('/').any(|segment| matches!(segment, "." | ".."))
+    path.is_empty() || safe_forward_path(path)
 }
 
 impl NativeRouteRequestHeaderPolicy {
diff --git a/crates/fluxheim-server/src/native_http1_route_proxy_tests.rs b/crates/fluxheim-server/src/native_http1_route_proxy_tests.rs
@@ -304,6 +304,38 @@ async fn native_route_proxy_redirect_rejects_query_path_traversal_expansion() {
     assert!(response.ends_with("invalid redirect target\n"));
 }
 
+#[tokio::test]
+async fn native_route_proxy_redirect_rejects_percent_encoded_query_path_traversal_expansion() {
+    let route = NativeHttp1RouteProxyRoute::exact_redirect(
+        "/file",
+        Vec::new(),
+        "https://cdn.example/files/{query}",
+        302,
+    );
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    let response = downstream_get(proxy, "/file?%2e%2e/%2e%2e/admin/secrets").await;
+
+    assert!(response.starts_with("HTTP/1.1 400 Bad Request\r\n"));
+    assert!(response.ends_with("invalid redirect target\n"));
+}
+
+#[tokio::test]
+async fn native_route_proxy_redirect_rejects_double_encoded_query_path_traversal_expansion() {
+    let route = NativeHttp1RouteProxyRoute::exact_redirect(
+        "/file",
+        Vec::new(),
+        "https://cdn.example/files/{query}",
+        302,
+    );
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    let response = downstream_get(proxy, "/file?%252e%252e/secret").await;
+
+    assert!(response.starts_with("HTTP/1.1 400 Bad Request\r\n"));
+    assert!(response.ends_with("invalid redirect target\n"));
+}
+
 #[tokio::test]
 async fn native_route_proxy_redirect_rejects_double_slash_location_path() {
     let route = NativeHttp1RouteProxyRoute::exact_redirect(
@@ -320,6 +352,22 @@ async fn native_route_proxy_redirect_rejects_double_slash_location_path() {
     assert!(response.ends_with("invalid redirect target\n"));
 }
 
+#[tokio::test]
+async fn native_route_proxy_redirect_rejects_percent_encoded_double_slash_location_path() {
+    let route = NativeHttp1RouteProxyRoute::exact_redirect(
+        "/file",
+        Vec::new(),
+        "https://cdn.example/files/{query}",
+        302,
+    );
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    let response = downstream_get(proxy, "/file?%2f%2fadmin").await;
+
+    assert!(response.starts_with("HTTP/1.1 400 Bad Request\r\n"));
+    assert!(response.ends_with("invalid redirect target\n"));
+}
+
 #[tokio::test]
 async fn native_route_proxy_rejects_route_body_over_limit() {
     let route = NativeHttp1RouteProxyRoute::exact(
diff --git a/crates/fluxheim-server/src/native_http1_route_static_web_tests.rs b/crates/fluxheim-server/src/native_http1_route_static_web_tests.rs
@@ -42,6 +42,14 @@ async fn downstream_get(proxy: std::net::SocketAddr, path: &str) -> String {
     .await
 }
 
+async fn downstream_post(proxy: std::net::SocketAddr, path: &str) -> String {
+    downstream_request(
+        proxy,
+        &format!("POST {path} HTTP/1.1\r\nHost: route.test\r\nConnection: close\r\nContent-Length: 0\r\n\r\n"),
+    )
+    .await
+}
+
 async fn downstream_request(proxy: std::net::SocketAddr, request: &str) -> String {
     let mut client = TcpStream::connect(proxy).await.unwrap();
     client.write_all(request.as_bytes()).await.unwrap();
@@ -126,6 +134,30 @@ async fn native_route_proxy_serves_static_web_range() {
     root.close().unwrap();
 }
 
+#[tokio::test]
+async fn native_route_proxy_static_web_rejects_non_get_head_method() {
+    let root = TempDir::new().unwrap();
+    fs::write(root.path().join("asset.txt"), b"native-static\n").unwrap();
+    let route = NativeHttp1RouteProxyRoute::prefix_static_web(
+        "/files/",
+        Vec::new(),
+        native_static_web(root.path()),
+    )
+    .with_strip_prefix("/files/");
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    let response = downstream_post(proxy, "/files/asset.txt").await;
+
+    assert!(response.starts_with("HTTP/1.1 405 Method Not Allowed\r\n"));
+    assert_eq!(
+        response_header(&response, "allow").as_deref(),
+        Some("GET, HEAD")
+    );
+    assert!(response.ends_with("method not allowed\n"));
+
+    root.close().unwrap();
+}
+
 #[tokio::test]
 async fn native_route_proxy_static_web_rejects_traversal() {
     let root = TempDir::new().unwrap();
diff --git a/crates/fluxheim-server/src/native_http1_static_web.rs b/crates/fluxheim-server/src/native_http1_static_web.rs
@@ -1,6 +1,6 @@
 use std::fs::File;
 use std::io::{self, Read, Seek};
-use std::path::{Path, PathBuf};
+use std::path::{Component, Path, PathBuf};
 use std::time::SystemTime;
 
 use fluxheim_config::{DirectoryListingConfig, WebConfig};
@@ -90,6 +90,12 @@ impl NativeHttp1StaticWeb {
     }
 
     pub fn handle(&self, request: &NativeHttp1Request, request_path: &str) -> NativeHttp1Response {
+        if !static_web_method_allowed(&request.method) {
+            return NativeHttp1Response::new(405, "Method Not Allowed", b"method not allowed\n")
+                .with_header("allow", "GET, HEAD")
+                .close_connection();
+        }
+
         match self.resolve(request_path) {
             Ok(NativeStaticResolve::Found(file)) => self.file_response(request, &file),
             Ok(NativeStaticResolve::DirectoryListing(listing)) => {
@@ -409,14 +415,61 @@ fn open_static_body_file(file: &NativeStaticFile) -> io::Result<File> {
             "static body path escaped web root",
         ));
     }
-    let metadata = std::fs::symlink_metadata(&canonical)?;
-    if metadata.file_type().is_symlink() || !metadata.is_file() {
+    let opened = open_static_body_file_at_root(file, &relative.as_path())?;
+    let metadata = opened.metadata()?;
+    if !metadata.is_file() {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             "static body path is not a regular file",
         ));
     }
-    File::open(canonical)
+    Ok(opened)
+}
+
+fn open_static_body_file_at_root(
+    file: &NativeStaticFile,
+    relative_path: &Path,
+) -> io::Result<File> {
+    let directory_flags =
+        rustix::fs::OFlags::RDONLY | rustix::fs::OFlags::DIRECTORY | rustix::fs::OFlags::CLOEXEC;
+    let nofollow_directory_flags = directory_flags | rustix::fs::OFlags::NOFOLLOW;
+    let file_flags =
+        rustix::fs::OFlags::RDONLY | rustix::fs::OFlags::CLOEXEC | rustix::fs::OFlags::NOFOLLOW;
+
+    let mut directory = rustix::fs::open(
+        &file.root,
+        nofollow_directory_flags,
+        rustix::fs::Mode::empty(),
+    )
+    .map_err(io::Error::from)?;
+    let mut components = relative_path.components().peekable();
+    while let Some(component) = components.next() {
+        let Component::Normal(name) = component else {
+            return Err(io::Error::new(
+                io::ErrorKind::InvalidInput,
+                "static body path is not relative",
+            ));
+        };
+        let name = Path::new(name);
+        if components.peek().is_some() {
+            directory = rustix::fs::openat(
+                &directory,
+                name,
+                nofollow_directory_flags,
+                rustix::fs::Mode::empty(),
+            )
+            .map_err(io::Error::from)?;
+        } else {
+            let file = rustix::fs::openat(&directory, name, file_flags, rustix::fs::Mode::empty())
+                .map_err(io::Error::from)?;
+            return Ok(File::from(file));
+        }
+    }
+
+    Err(io::Error::new(
+        io::ErrorKind::InvalidInput,
+        "static body path is empty",
+    ))
 }
 
 fn directory_listing_response(
@@ -436,6 +489,10 @@ fn directory_listing_response(
         .with_header("cache-control", "private, no-store")
 }
 
+fn static_web_method_allowed(method: &str) -> bool {
+    matches!(method, "GET" | "HEAD")
+}
+
 fn static_reason(status: u16) -> &'static str {
     match status {
         200 => "OK",
@@ -470,3 +527,36 @@ fn content_type_for_path(path: &Path) -> &'static str {
         _ => "application/octet-stream",
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::time::SystemTime;
+
+    use tempfile::TempDir;
+
+    use super::{NativeStaticFile, open_static_body_file};
+
+    #[cfg(unix)]
+    #[test]
+    fn open_static_body_file_rejects_symlink_swapped_after_resolution() {
+        let root = TempDir::new().unwrap();
+        let asset = root.path().join("asset.txt");
+        let outside = root.path().join("outside.txt");
+        std::fs::write(&asset, b"safe").unwrap();
+        std::fs::write(&outside, b"outside").unwrap();
+        let root_path = root.path().canonicalize().unwrap();
+        let file = NativeStaticFile {
+            root: root_path.clone(),
+            path: root_path.join("asset.txt"),
+            mime: "text/plain; charset=utf-8",
+            len: 4,
+            modified: Some(SystemTime::UNIX_EPOCH),
+        };
+
+        std::fs::remove_file(&asset).unwrap();
+        std::os::unix::fs::symlink(&outside, &asset).unwrap();
+
+        assert!(open_static_body_file(&file).is_err());
+        root.close().unwrap();
+    }
+}
diff --git a/docs/modularity-exceptions.md b/docs/modularity-exceptions.md
@@ -50,7 +50,7 @@ documents why the exception is temporary and how it will be removed.
 | `crates/fluxheim-config/src/reload.rs` | 809 | Reload classification and diff behavior. | Move snapshot/reload-safe classification into dedicated modules. |
 | `crates/fluxheim-php-fpm/src/lib.rs` | 778 | PHP-FPM crate root still holds several pure domains. | Split params, response, retry, and managed runtime helpers. |
 | `crates/fluxheim-config/src/config_admin.rs` | 755 | Admin config and validation. | Split ops socket, snapshots, auth, and status config. |
-| `crates/fluxheim-load-balancer/src/persistence.rs` | 753 | Persistence, cookies, and request-view helpers. | Split cookie, header, source-IP, and state table helpers. |
+| `crates/fluxheim-load-balancer/src/persistence.rs` | 769 | Persistence, cookies, constant-time managed-cookie checks, and request-view helpers. | Split cookie, header, source-IP, and state table helpers. |
 | `crates/fluxheim-config/src/config_acme.rs` | 719 | ACME config and validation. | Move with `fluxheim-acme`. |
 | `src/config_tester.rs` | 716 | Config tester CLI and profile logic. | Split profile checks from CLI output. |
 | `crates/fluxheim-web/src/lib.rs` | 708 | Static web crate root. | Split range, directory listing, path safety, and response planning. |
@@ -65,8 +65,9 @@ documents why the exception is temporary and how it will be removed.
 | `crates/fluxheim-server/src/native_http1_tests.rs` | 605 | Native downstream HTTP/1 listener tests temporarily group request parsing, keep-alive, timeout, body, and listener-budget fixtures for parity review. | Split listener, request-body, timeout, and response-framing tests after the native HTTP/1 API stabilizes. |
 | `crates/fluxheim-server/src/server_tests.rs` | 567 | Server-plan and runtime-cutover policy tests grew during the `1.6.19` native TLS/listener proof work. | Split listener inventory, native-runtime blockers, HTTP policy mapping, and background service tests into focused modules. |
 | `crates/fluxheim-server/src/native_http1_client_tests.rs` | 539 | Native HTTP/1 upstream client tests temporarily group response parsing, pooling, stale-connection retry, timeout, and forwarded-header fixtures. | Split client pooling/retry tests from response/timeout/header tests as the native upstream client stabilizes. |
-| `crates/fluxheim-server/src/native_http1_route_proxy_tests.rs` | 525 | Native route-proxy tests temporarily group route matching, redirects, request/response header overlays, response rewrites, and route static-web fixtures for the rich route cutover slices. | Split redirect, header-policy, response-rewrite, and static-web route tests before final native runtime cutover. |
+| `crates/fluxheim-server/src/native_http1_route_proxy_tests.rs` | 573 | Native route-proxy tests temporarily group route matching, safe redirect expansion including encoded and double-encoded path hardening, request/response header overlays, response rewrites, and route static-web fixtures for the rich route cutover slices. | Split redirect, header-policy, response-rewrite, and static-web route tests before final native runtime cutover. |
 | `crates/fluxheim-server/src/native_http1_plan_tests.rs` | 838 | Native HTTP/1 cutover planning tests grew during the `1.6.26`-`1.6.27` route/policy parity slices to cover request-header mutations, response-header overlays, response rewrites, static weights, and redirect-shadowed route proxies together. | Split route-policy candidate tests from vhost/root candidate tests before the final Pingora dependency deletion. |
-| `crates/fluxheim-server/src/native_http1_route_proxy.rs` | 767 | Native route proxy temporarily groups route matching, safe redirect expansion, request-body limits, request/response-header overlays, response rewrites, and static-web route action dispatch during the `1.6.26`-`1.6.27` route/rich-integration parity slices. | Split redirect handling, header policy helpers, response rewrite helpers, and static-web dispatch into focused modules before final native runtime cutover. |
+| `crates/fluxheim-server/src/native_http1_route_proxy.rs` | 767 | Native route proxy temporarily groups route matching, safe redirect expansion including multi-pass path validation, request-body limits, request/response-header overlays, response rewrites, and static-web route action dispatch during the `1.6.26`-`1.6.27` route/rich-integration parity slices. | Split redirect handling, header policy helpers, response rewrite helpers, and static-web dispatch into focused modules before final native runtime cutover. |
+| `crates/fluxheim-server/src/native_http1_static_web.rs` | 562 | Native static-web route adapter groups path resolution, directory listing, static response planning, method enforcement, and rooted no-symlink body opening for the `1.6.27` security-reviewed route static-web slice. | Split path resolution/opening, directory listing, and response planning helpers before final native runtime cutover. |
 | `src/edge_policy.rs` | 532 | Edge access/rate/geo policy. | Split policy decisions and runtime proof types. |
 | `crates/fluxheim-cache/src/request.rs` | 545 | Cache request/range/slice planning plus native cache key identity. | Split key identity and range/slice planning if it grows further. |
diff --git a/packaging/rpm/fluxheim.spec b/packaging/rpm/fluxheim.spec
@@ -165,8 +165,10 @@ fi
 - Apply static proxy.upstream_weights through native weighted round-robin.
 - Apply route-level native response rewrites for Location, Refresh, and
   Set-Cookie.
-- Harden native static path containment, symlink rejection, and body-open
-  revalidation.
+- Harden native static path containment with rooted no-symlink body opens and
+  method enforcement for non-GET/HEAD requests.
+- Harden native redirect Location validation for encoded and double-encoded
+  dot segments and slashes produced by template expansion.
 - Keep forwarded-client-IP shortcut ownership on the compatibility path until
   native parity tests cover it.
 - Keep health-aware, persistence, priority-group, backup/drain, dynamic
diff --git a/release-notes/RELEASE_NOTES_1.6.27.md b/release-notes/RELEASE_NOTES_1.6.27.md
@@ -27,8 +27,15 @@ web serving onto the native HTTP/1 route adapter.
 
 - Native static-web path resolution rejects decoded dot segments, NUL bytes,
   backslashes, denied dotfiles, and symlink escapes.
-- Static response body reads re-check the rooted path and regular-file status
-  before opening the file.
+- Static response body reads use rooted component-by-component `openat` with
+  no-symlink opens for every directory component and the final file, closing the
+  symlink-swap window between metadata checks and body reads.
+- Native route static-web handling now rejects methods other than `GET` and
+  `HEAD` with `405 Method Not Allowed`, even when the route method list matches
+  all methods.
+- Native redirect `Location` path validation now reuses the bounded multi-pass
+  forward-path safety check, rejecting single- and double-encoded dot-segment
+  or slash expansions from `{query}`, `{path}`, or `{uri}` templates.
 - Buffered native static responses are capped at 64 MiB until the final native
   streaming body path is completed.
 - Forwarded-client-IP shortcut ownership remains a compatibility-path blocker;

Original file line number	Diff line number	Diff line change
`@@ -579,7 +579,7 @@ fn redirect_location_path_safe(location: &str) -> bool {`
`579`	`579`	`.find(['?', '#'])`
`580`	`580`	`.unwrap_or(path_and_tail.len());`
`581`	`581`	`let path = &path_and_tail[..path_end];`
`582`		`- !path.contains("//") && !path.split('/').any(\|segment\| matches!(segment, "." \| ".."))`
	`582`	`+ path.is_empty() \|\| safe_forward_path(path)`
`583`	`583`	`}`
`584`	`584`
`585`	`585`	`impl NativeRouteRequestHeaderPolicy {`