restrict vfs access to home path (#9312)

* restrict vfs access to home path

* Adding test, code clean up

Author: soninaren

src/WebJobs.Script.WebHost/Management/VirtualFileSystem.cs

@@ -61,6 +61,11 @@ public virtual Task<HttpResponseMessage> GetItem(HttpRequest request)
         {
             string localFilePath = GetLocalFilePath(request);
 
+            if (!PathAccessAllowed(localFilePath))
+            {
+                return Task.FromResult(CreateResponse(HttpStatusCode.Forbidden));
+            }
+
             if (VfsSpecialFolders.TryHandleRequest(request, localFilePath, out HttpResponseMessage response))
             {
                 return Task.FromResult(response);
@@ -111,6 +116,11 @@ public virtual Task<HttpResponseMessage> PutItem(HttpRequest request)
         {
             var localFilePath = GetLocalFilePath(request);
 
+            if (!PathAccessAllowed(localFilePath))
+            {
+                return Task.FromResult(CreateResponse(HttpStatusCode.Forbidden));
+            }
+
             if (VfsSpecialFolders.TryHandleRequest(request, localFilePath, out HttpResponseMessage response))
             {
                 return Task.FromResult(response);
@@ -140,6 +150,11 @@ public virtual Task<HttpResponseMessage> DeleteItem(HttpRequest request, bool re
         {
             string localFilePath = GetLocalFilePath(request);
 
+            if (!PathAccessAllowed(localFilePath))
+            {
+                return Task.FromResult(CreateResponse(HttpStatusCode.Forbidden));
+            }
+
             if (VfsSpecialFolders.TryHandleRequest(request, localFilePath, out HttpResponseMessage response))
             {
                 return Task.FromResult(response);
@@ -633,5 +648,12 @@ protected HttpResponseMessage CreateResponse(HttpStatusCode statusCode, object p
             }
             return response;
         }
+
+        private bool PathAccessAllowed(string path)
+        {
+            var home = ScriptSettingsManager.Instance.GetSetting(EnvironmentSettingNames.AzureWebsiteHomePath);
+            var sitePath = !string.IsNullOrEmpty(home) ? Path.Combine(Path.GetFullPath(home), "site", "wwwroot") : _options.CurrentValue.ScriptPath;
+            return path.StartsWith(sitePath, StringComparison.OrdinalIgnoreCase);
+        }
     }
 }

test/WebJobs.Script.Tests.Integration/WebHostEndToEnd/EndToEndTestFixture.cs

@@ -83,6 +83,8 @@ protected EndToEndTestFixture(string rootPath, string testId,
 
         public string MasterKey { get; private set; }
 
+        public string RootScriptPath { get; private set; }
+
         protected virtual ExtensionPackageReference[] GetExtensionsToInstall()
         {
             return null;
@@ -173,6 +175,7 @@ string GetDestPath(int counter)
             }
 
             MasterKey = await Host.GetMasterKeyAsync();
+            RootScriptPath = _copiedRootPath;
         }
 
         public virtual void ConfigureScriptHost(IWebJobsBuilder webJobsBuilder)

test/WebJobs.Script.Tests.Integration/WebHostEndToEnd/SamplesEndToEndTests_CSharp.cs

@@ -218,6 +218,32 @@ public async Task AdminIsolation_ReturnsExpectedStatus(string uri, bool isAppSer
             }
         }
 
+
+
+        [Theory]
+        [InlineData("admin/vfs/site/wwwroot/host.json", HttpStatusCode.OK)]
+        [InlineData("admin/vfs/host.json", HttpStatusCode.Forbidden)]
+        public async Task AccessPathOutsideHome_ReturnsExpectedStatus(string uri, HttpStatusCode expectedStatus)
+        {
+            HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, uri);
+            await this._fixture.AddMasterKey(request);
+
+            string nowString = DateTime.UtcNow.ToString("yyMMdd-HHmmss");
+            string home = Path.Combine(Path.GetTempPath(), nowString, "home");
+            string wwwroot = Path.Combine(home, "site", "wwwroot");
+            FileUtility.CopyDirectory(this._fixture.RootScriptPath, wwwroot);
+
+            using var envVars = new TestScopedEnvironmentVariable(EnvironmentSettingNames.AzureWebsiteHomePath, home);
+            {
+                using (var httpClient = _fixture.Host.CreateHttpClient())
+                {
+                    HttpResponseMessage response = await httpClient.SendAsync(request);
+                    Assert.Equal(expectedStatus, response.StatusCode);
+                }
+
+            }
+        }
+
         [Theory]
         [InlineData("GET")]
         [InlineData("POST")]