PathValidator.cpp

//===-- PathValidator.cpp - Path sandboxing ---------------------*- C++ -*-===//
//
// Part of the ZBC semihosting monorepo. MIT licensed (see LICENSE).
//
//===----------------------------------------------------------------------===//

#include "zbc/PathValidator.h"

#include <filesystem>
#include <system_error>

namespace fs = std::filesystem;

namespace zbc {

namespace {
/// Resolve "..", ".", and symlinks without requiring the path to exist
/// (so newly-created files validate). Returns empty on failure.
std::string resolveReal(const fs::path &P) {
  std::error_code EC;
  fs::path R = fs::weakly_canonical(P, EC);
  if (EC)
    return {};
  return R.string();
}
} // namespace

PathValidator::PathValidator(PathValidatorConfig Config)
    : Config(std::move(Config)) {
  if (!Config.SandboxDir.empty()) {
    std::string Resolved = resolveReal(Config.SandboxDir);
    if (Resolved.empty()) {
      // SECURITY: cannot resolve sandbox root -> deny everything.
      reportViolation(ViolationType::SandboxEscape, Config.SandboxDir);
      Config.SandboxDir.clear();
      return;
    }
    // Store with a trailing separator for prefix matching.
    if (Resolved.back() != static_cast<char>(fs::path::preferred_separator))
      Resolved.push_back(static_cast<char>(fs::path::preferred_separator));
    Config.SandboxDir = std::move(Resolved);
  }
}

Result<std::string> PathValidator::validate(std::string_view Path,
                                            bool ForWrite,
                                            bool FollowLeafSymlink) const {
  if (Path.find('\0') != std::string_view::npos) {
    reportViolation(ViolationType::NullByte, Path);
    return Result<std::string>::error("path contains null byte");
  }
  if (ForWrite && Config.ReadOnly) {
    reportViolation(ViolationType::WriteProtected, Path);
    return Result<std::string>::error("write denied (read-only mode)");
  }

  // Make relative paths relative to the sandbox root.
  fs::path Requested(Path);
  fs::path Combined;
  if (Requested.is_relative() && !Config.SandboxDir.empty())
    Combined = fs::path(Config.SandboxDir) / Requested;
  else
    Combined = Requested;

  // For LSTAT / READLINK we must not resolve the final component (or
  // weakly_canonical would silently leave us pointed at the symlink's
  // target). Canonicalize the parent and rejoin the leaf -- that catches
  // traversal through the parent while preserving the leaf-as-symlink
  // semantics the opcode needs.
  std::string Resolved;
  if (!FollowLeafSymlink && Combined.has_parent_path() &&
      Combined.has_filename()) {
    std::error_code EC;
    fs::path ParentResolved = fs::weakly_canonical(Combined.parent_path(), EC);
    if (!EC)
      Resolved = (ParentResolved / Combined.filename()).string();
  } else {
    Resolved = resolveReal(Combined);
  }

  if (Resolved.empty()) {
    // SECURITY: an unresolvable path could hide a traversal/symlink escape.
    reportViolation(ViolationType::SandboxEscape, Path);
    return Result<std::string>::error("cannot verify path within sandbox");
  }

  if (!isAllowed(Resolved, ForWrite)) {
    reportViolation(ForWrite ? ViolationType::WriteProtected
                             : ViolationType::NotAllowed,
                    Path);
    return Result<std::string>::error("access denied");
  }

  return Resolved;
}

bool PathValidator::isAllowed(const std::string &ResolvedPath,
                              bool ForWrite) const {
  if (!Config.SandboxDir.empty()) {
    // SandboxDir has a trailing separator; allow the dir itself or anything
    // beneath it.
    std::string NoSep = Config.SandboxDir;
    NoSep.pop_back();
    if (ResolvedPath == NoSep ||
        ResolvedPath.compare(0, Config.SandboxDir.size(),
                             Config.SandboxDir) == 0)
      return true;
  }
  for (const auto &Rule : Config.AllowedPaths) {
    const std::string &Prefix = Rule.first;
    bool AllowWrite = Rule.second;
    if (ResolvedPath.compare(0, Prefix.size(), Prefix) == 0) {
      if (!ForWrite || AllowWrite)
        return true;
    }
  }
  return false;
}

void PathValidator::reportViolation(ViolationType Type,
                                    std::string_view Path) const {
  if (Config.OnViolation)
    Config.OnViolation(Type, Path);
}

void PathValidator::addAllowedPath(std::string_view Prefix, bool AllowWrite) {
  std::string Resolved = resolveReal(fs::path(Prefix));
  if (Resolved.empty())
    Resolved = std::string(Prefix);
  Config.AllowedPaths.emplace_back(std::move(Resolved), AllowWrite);
}

} // namespace zbc