mirror of
https://github.com/flatpak/flatpak.git
synced 2026-09-12 22:22:09 -04:00
Sebastian Wick
9a8374fb7a
ensure_extensions() used g_file_resolve_relative_path() with ext->directory, which comes from runtime/SDK metadata and can contain ".." components. This allowed a malicious extension to write outside the build directory. Replace the GFile-based path resolution with glnx_chase_and_mkdirat() using GLNX_CHASE_RESOLVE_BENEATH | GLNX_CHASE_RESOLVE_NO_SYMLINKS, which rejects any path that escapes the directory fd. Convert the rest of flatpak_builtin_build_init to fd-relative operations (mkdirat, symlinkat, glnx_opendirat, glnx_shutil_rm_rf_at, glnx_file_replace_contents_at, flatpak_cp_a_at) anchored to a base_dfd opened from the build directory. Resolves: https://github.com/flatpak/flatpak/security/advisories/GHSA-8qxj-x646-phcm