🐛 Preserve sensitive home path checks across workspace aliases #19178

Author: 88250

kernel/util/path.go

@@ -550,26 +550,33 @@ func isSensitivePath(p string) bool {
 	// 覆盖常见凭据 dotfile，防止通过 globalCopyFiles 等接受工作空间外绝对路径的接口把内核用户
 	// 家目录下的凭据复制进工作空间后外泄：Git push token、HTTP/API 凭据、Postgres 密码、
 	// K8s/Docker/容器仓库配置、GPG 私钥环、云厂商 CLI 凭据、包管理器 token 等。
-	homePrefixes := []string{
-		strings.ToLower(filepath.Join(HomeDir, ".ssh")),
-		strings.ToLower(filepath.Join(HomeDir, ".config")),
-		strings.ToLower(filepath.Join(HomeDir, ".bashrc")),
-		strings.ToLower(filepath.Join(HomeDir, ".zshrc")),
-		strings.ToLower(filepath.Join(HomeDir, ".profile")),
-		strings.ToLower(filepath.Join(HomeDir, ".git-credentials")),
-		strings.ToLower(filepath.Join(HomeDir, ".netrc")),
-		strings.ToLower(filepath.Join(HomeDir, ".pgpass")),
-		strings.ToLower(filepath.Join(HomeDir, ".kube")),
-		strings.ToLower(filepath.Join(HomeDir, ".docker")),
-		strings.ToLower(filepath.Join(HomeDir, ".gnupg")),
-		strings.ToLower(filepath.Join(HomeDir, ".aws")),
-		strings.ToLower(filepath.Join(HomeDir, ".azure")),
-		strings.ToLower(filepath.Join(HomeDir, ".npmrc")),
-		strings.ToLower(filepath.Join(HomeDir, ".pypirc")),
-	}
-	for _, hp := range homePrefixes {
-		if strings.HasPrefix(toCheckPathLower, hp) {
-			return true
+	homeDirs := []string{HomeDir}
+	homeCheckPaths := []string{toCheckPathLower}
+	if HomeDir != "" && !gulu.File.IsSubPath(HomeDir, p) {
+		// 工作空间真实路径获得系统目录豁免后，仍需匹配家目录真实路径下的敏感位置。
+		if resolved, err := filepath.EvalSymlinks(HomeDir); err == nil && resolved != HomeDir {
+			homeDirs = append(homeDirs, resolved)
+		}
+		// 家目录已是真实路径而目标仍使用工作空间别名时，按工作空间根目录映射目标。
+		// 只映射根目录，保留对尚未创建的导出目标及工作空间内路径的检查。
+		if inWorkspace && workspaceDir == WorkspaceDir {
+			if resolved, err := filepath.EvalSymlinks(workspaceDir); err == nil && resolved != workspaceDir {
+				if rel, err := filepath.Rel(workspaceDir, p); err == nil {
+					homeCheckPaths = append(homeCheckPaths, strings.ToLower(filepath.Join(resolved, rel)))
+				}
+			}
+		}
+	}
+	for _, homeDir := range homeDirs {
+		for _, name := range []string{
+			".ssh", ".config", ".bashrc", ".zshrc", ".profile", ".git-credentials", ".netrc", ".pgpass",
+			".kube", ".docker", ".gnupg", ".aws", ".azure", ".npmrc", ".pypirc",
+		} {
+			for _, checkPath := range homeCheckPaths {
+				if strings.HasPrefix(checkPath, strings.ToLower(filepath.Join(homeDir, name))) {
+					return true
+				}
+			}
 		}
 	}
 

kernel/util/path_alias_test.go

@@ -0,0 +1,80 @@
+// SiYuan - From thought to insight, with agents
+// Copyright (c) 2020-present, b3log.org
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package util
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestSensitivePathAliases 验证工作空间及家目录别名使用一致的敏感路径规则。
+func TestSensitivePathAliases(t *testing.T) {
+	realHome, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	alias := filepath.Join(t.TempDir(), "home")
+	origHome, origWorkspace := HomeDir, WorkspaceDir
+	t.Cleanup(func() { HomeDir, WorkspaceDir = origHome, origWorkspace })
+	if err := os.MkdirAll(filepath.Join(realHome, "home"), 0755); err != nil {
+		t.Fatal(err)
+	}
+	for _, layout := range []string{"SiYuan", ".config/SiYuan", "siyuan"} {
+		for _, rel := range []string{"data/emojis/robot.svg", "conf/conf.json", "temp/private.txt", "temp/export/doc.html"} {
+			p := filepath.Join(realHome, filepath.FromSlash(layout), filepath.FromSlash(rel))
+			if err := os.MkdirAll(filepath.Dir(p), 0755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(p, []byte("fixture"), 0600); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if err := os.Symlink(realHome, alias); err != nil {
+		t.Skipf("create directory symlink failed: %s", err)
+	}
+	for _, layout := range []string{"SiYuan", ".config/SiYuan", "siyuan"} {
+		t.Run(layout, func(t *testing.T) {
+			HomeDir = alias
+			if layout == "siyuan" {
+				HomeDir = filepath.Join(alias, "home")
+			}
+			WorkspaceDir = filepath.Join(alias, filepath.FromSlash(layout))
+			resolved, err := filepath.EvalSymlinks(WorkspaceDir)
+			if err != nil {
+				t.Fatalf("resolve %q: %v", WorkspaceDir, err)
+			}
+			// 新导出目标尚不存在时也应保留相同的目录访问规则。
+			for _, rel := range []string{"data/emojis/robot.svg", "conf/conf.json", "temp/private.txt", "temp/export/doc.html", "conf/new.json", "temp/export/new.html"} {
+				want := layout == ".config/SiYuan" || rel == "conf/conf.json" || rel == "conf/new.json" || rel == "temp/private.txt"
+				for _, home := range []string{alias, realHome} {
+					HomeDir = home
+					if layout == "siyuan" {
+						HomeDir = filepath.Join(home, "home")
+					}
+					for _, root := range []string{WorkspaceDir, resolved} {
+						p := filepath.Join(root, filepath.FromSlash(rel))
+						if got := IsSensitivePath(p); got != want {
+							t.Errorf("IsSensitivePath(%q) = %v, want %v (home %q)", p, got, want, home)
+						}
+					}
+				}
+			}
+		})
+	}
+}