🐛 Restore static resources in symlinked workspaces #19178

Author: 88250

kernel/server/serve_static_test.go

@@ -166,6 +166,75 @@ func TestStaticFileNestedSymlinkEscape(t *testing.T) {
 	}
 }
 
+// TestStaticFileSymlinkWorkspace 验证工作空间父目录符号链接不影响资源访问及敏感路径拦截。
+func TestStaticFileSymlinkWorkspace(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	realHome, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	linkedHome := filepath.Join(t.TempDir(), "home")
+	if err = os.Symlink(realHome, linkedHome); err != nil {
+		t.Skipf("create directory symlink failed: %s", err)
+	}
+	originalWorkspace := util.WorkspaceDir
+	util.WorkspaceDir = filepath.Join(linkedHome, ".var", "app", "org.b3log.siyuan", "SiYuan")
+	t.Cleanup(func() { util.WorkspaceDir = originalWorkspace })
+	for _, rel := range []string{
+		"data/emojis/fontawesome-free-solid/robot.svg",
+		"data/widgets/listChildDocs/index.html",
+		"data/widgets/listChildDocs/app.js",
+		"data/widgets/listChildDocs/credentials.json",
+		"conf/conf.json",
+		"temp/private.txt",
+	} {
+		p := filepath.Join(util.WorkspaceDir, filepath.FromSlash(rel))
+		if err = os.MkdirAll(filepath.Dir(p), 0755); err != nil {
+			t.Fatal(err)
+		}
+		if err = os.WriteFile(p, []byte("content"), 0644); err != nil {
+			t.Fatal(err)
+		}
+	}
+	widgets := filepath.Join(util.WorkspaceDir, "data", "widgets")
+	for _, dir := range []string{"conf", "temp"} {
+		if err = os.Symlink(filepath.Join(util.WorkspaceDir, dir), filepath.Join(widgets, dir)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err = os.Symlink(filepath.Join(util.WorkspaceDir, "conf"), filepath.Join(widgets, "listChildDocs", "escape")); err != nil {
+		t.Fatal(err)
+	}
+	engine := gin.New()
+	registerStaticFileHandlers(engine.Group("/emojis"), filepath.Join(util.WorkspaceDir, "data", "emojis"), false, nil)
+	registerStaticFileHandlers(engine.Group("/widgets"), widgets, true, nil)
+	for _, test := range []struct {
+		path   string
+		status int
+	}{
+		{"/emojis/fontawesome-free-solid/robot.svg", http.StatusOK},
+		{"/widgets/listChildDocs/", http.StatusOK},
+		{"/widgets/listChildDocs/app.js", http.StatusOK},
+		{"/widgets/listChildDocs/credentials.json", http.StatusForbidden},
+		{"/widgets/conf/conf.json", http.StatusForbidden},
+		{"/widgets/temp/private.txt", http.StatusForbidden},
+		{"/widgets/listChildDocs/escape/conf.json", http.StatusForbidden},
+	} {
+		for _, method := range []string{http.MethodGet, http.MethodHead} {
+			t.Run(method+" "+test.path, func(t *testing.T) {
+				recorder := httptest.NewRecorder()
+				engine.ServeHTTP(recorder, httptest.NewRequest(method, test.path, nil))
+				if recorder.Code != test.status {
+					t.Fatalf("status = %d, want %d", recorder.Code, test.status)
+				}
+				if method == http.MethodGet && test.status == http.StatusOK && recorder.Body.String() != "content" {
+					t.Fatalf("unexpected response body: %q", recorder.Body.String())
+				}
+			})
+		}
+	}
+}
+
 func TestWidgetResponseCacheControl(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	originalDataDir, originalConf := util.DataDir, model.Conf

kernel/util/path.go

@@ -467,17 +467,24 @@ func IsSensitivePath(p string) bool {
 	return false
 }
 
-// isSensitivePath 执行实际的敏感性黑名单匹配，不解析符号链接。
+// isSensitivePath 执行敏感性黑名单匹配，必要时解析工作空间路径，但不解析目标路径。
 func isSensitivePath(p string) bool {
 	toCheckPathLower := filepath.Clean(strings.ToLower(p))
 	toCheckNameLower := filepath.Base(toCheckPathLower)
+	workspaceDir := WorkspaceDir
+	inWorkspace := gulu.File.IsSubPath(workspaceDir, p)
+	if !inWorkspace && workspaceDir != "" {
+		// 静态资源使用解析后的真实路径，工作空间也需采用相同形式判断归属及 conf、temp 目录。
+		// 仅解析工作空间根目录，不能将指向外部敏感文件的资源符号链接视为工作空间内文件。
+		if resolved, err := filepath.EvalSymlinks(workspaceDir); err == nil && gulu.File.IsSubPath(resolved, p) {
+			workspaceDir = resolved
+			inWorkspace = true
+		}
+	}
 
-	// 系统目录前缀检查仅对工作空间外的路径执行。
-	// 调用方传入的工作空间内路径（如 assets、export）都已用 IsSubPath(WorkspaceDir) 校验过，
-	// 工作空间不可能位于 /etc、/var/log 等系统敏感目录；而 iOS 等沙箱平台的合法数据路径恰好以
-	// /var 开头（/var/mobile/Containers/Data/Application/...），对工作空间内路径执行系统目录前缀
-	// 检查会把 iOS 上正常的 assets/export 文件误判为敏感路径，导致伺服返回 403。
-	if !gulu.File.IsSubPath(WorkspaceDir, p) {
+	// 系统目录前缀检查仅对工作空间外的路径执行，工作空间内仍需检查配置、临时文件和凭据。
+	// iOS 沙箱及 Linux /var/home 下的合法工作空间可能位于 /var，需按工作空间边界判断。
+	if !inWorkspace {
 		// 敏感目录前缀（UNIX 风格）
 		prefixes := []string{
 			"/.",
@@ -527,14 +534,14 @@ func isSensitivePath(p string) bool {
 	}
 
 	// 工作空间/conf 目录（小写比较）
-	workspaceConfPrefix := strings.ToLower(filepath.Join(WorkspaceDir, "conf"))
+	workspaceConfPrefix := strings.ToLower(filepath.Join(workspaceDir, "conf"))
 	if strings.HasPrefix(toCheckPathLower, workspaceConfPrefix) {
 		return true
 	}
 
 	// 只允许导出工作空间/temp/export 目录，不允许导出工作空间/temp 目录（小写比较）
-	workspaceTempExportPrefix := strings.ToLower(filepath.Join(WorkspaceDir, "temp", "export"))
-	workspaceTempPrefix := strings.ToLower(filepath.Join(WorkspaceDir, "temp"))
+	workspaceTempExportPrefix := strings.ToLower(filepath.Join(workspaceDir, "temp", "export"))
+	workspaceTempPrefix := strings.ToLower(filepath.Join(workspaceDir, "temp"))
 	if strings.HasPrefix(toCheckPathLower, workspaceTempPrefix) && !strings.HasPrefix(toCheckPathLower, workspaceTempExportPrefix) {
 		return true
 	}

kernel/util/path_test.go

@@ -169,3 +169,57 @@ func TestIsSensitivePathWorkspaceFilesNotBlocked(t *testing.T) {
 		}
 	}
 }
+
+// TestIsSensitivePathSymlinkWorkspace 验证工作空间父目录为符号链接时的真实路径判定。
+func TestIsSensitivePathSymlinkWorkspace(t *testing.T) {
+	realHome, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	linkedHome := filepath.Join(t.TempDir(), "home")
+	if err = os.Symlink(realHome, linkedHome); err != nil {
+		t.Skipf("create directory symlink failed: %s", err)
+	}
+	relWorkspace := filepath.Join(".var", "app", "org.b3log.siyuan", "SiYuan")
+	realWorkspace := filepath.Join(realHome, relWorkspace)
+	if err = os.MkdirAll(realWorkspace, 0755); err != nil {
+		t.Fatal(err)
+	}
+	originalHome, originalWorkspace := HomeDir, WorkspaceDir
+	HomeDir, WorkspaceDir = realHome, filepath.Join(linkedHome, relWorkspace)
+	t.Cleanup(func() { HomeDir, WorkspaceDir = originalHome, originalWorkspace })
+
+	for _, test := range []struct {
+		rel       string
+		sensitive bool
+	}{
+		{"data/emojis/fontawesome-free-solid/robot.svg", false},
+		{"data/widgets/listChildDocs/index.html", false},
+		{"data/assets/image.png", false},
+		{"temp/export/document.html", false},
+		{"conf/conf.json", true},
+		{"temp/private.txt", true},
+		{"data/widgets/example/credentials.json", true},
+		{"data/widgets/example/id_rsa", true},
+	} {
+		t.Run(test.rel, func(t *testing.T) {
+			for _, root := range []string{WorkspaceDir, realWorkspace} {
+				p := filepath.Join(root, filepath.FromSlash(test.rel))
+				if got := IsSensitivePath(p); got != test.sensitive {
+					t.Errorf("IsSensitivePath(%q) = %v, want %v", p, got, test.sensitive)
+				}
+			}
+		})
+	}
+
+	// 工作空间外的凭据不能因工作空间解析成功而获得放行。
+	if p := filepath.Join(realHome, ".ssh", "id_rsa"); !IsSensitivePath(p) {
+		t.Errorf("external credential should be sensitive: %s", p)
+	}
+	if filepath.Separator == '/' {
+		// Linux 临时目录同样命中系统目录黑名单，可覆盖 /var/home 场景且不写入系统家目录。
+		if !isSensitivePath(filepath.Join(realWorkspace+"-outside", "public.txt")) {
+			t.Fatal("workspace prefix sibling should remain sensitive")
+		}
+	}
+}