Commit 4ea9f5e
authored
build(deps): bump github.com/cyphar/filepath-securejoin from 0.5.0 to 0.6.0 (#113)
Bumps
[github.com/cyphar/filepath-securejoin](https://github.com/cyphar/filepath-securejoin)
from 0.5.0 to 0.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/cyphar/filepath-securejoin/releases">github.com/cyphar/filepath-securejoin's
releases</a>.</em></p>
<blockquote>
<h2>v0.6.0 -- "By the Power of Greyskull!"</h2>
<p>While quite small code-wise, this release marks a very key point in
the
development of filepath-securejoin.</p>
<p>filepath-securejoin was originally intended (back in 2017) to simply
be a
single-purpose library that would take some common code used in
container
runtimes (specifically, Docker's <code>FollowSymlinksInScope</code>) and
make it more
general-purpose (with the eventual goals of it ending up in the Go
stdlib).</p>
<p>Of course, I quickly discovered that this problem was actually far
more
complicated to solve when dealing with racing attackers, which lead to
me
developing <code>openat2(2)</code> and <a
href="https://github.com/cyphar/libpathrs">libpathrs</a>. I had
originally planned for
libpathrs to completely replace filepath-securejoin "once it was
ready" but in
the interim we needed to fix several race attacks in runc as part of
security
advisories. Obviously we couldn't require the usage of a pre-0.1 Rust
library
in runc so it was necessary to port bits of libpathrs into
filepath-securejoin.
(Ironically the first prototypes of libpathrs were originally written in
Go and
then rewritten to Rust, so the code in filepath-securejoin is actually
Go code
that was rewritten to Rust then re-rewritten to Go.)</p>
<p>It then became clear that pure-Go libraries will likely not be
willing to
require CGo for all of their builds, so it was necessary to accept that
filepath-securejoin will need to stay. As such, in v0.5.0 we provided
more
pure-Go implementations of features from libpathrs but moved them into
<code>pathrs-lite</code> subpackage to clarify what purpose these
helpers serve.</p>
<p>This release finally closes the loop and makes it so that pathrs-lite
can
transparently use libpathrs (via a <code>libpathrs</code> build-tag).
This means that
upstream libraries can use the pure Go version if they prefer, but
downstreams
(either downstream library users or even downstream distributions) are
able to
migrate to libpathrs for all usages of pathrs-lite in an entire Go
binary.</p>
<p>I should make it clear that I do not plan to port the rest of
libpathrs to Go,
as I do not wish to maintain two copies of the same codebase.
pathrs-lite
already provides the core essentials necessary to operate on paths
safely for
most modern systems. Users who want additional hardening or more
ergonomic APIs
are free to use <a
href="https://cyphar.com/go-pathrs"><code>cyphar.com/go-pathrs</code></a>
(libpathrs's Go bindings).</p>
<h3>Breaking</h3>
<ul>
<li>The deprecated <code>MkdirAll</code>, <code>MkdirAllHandle</code>,
<code>OpenInRoot</code>, <code>OpenatInRoot</code> and
<code>Reopen</code> wrappers have been removed. Please switch to using
<code>pathrs-lite</code>
directly.</li>
</ul>
<h3>Added</h3>
<ul>
<li><code>pathrs-lite</code> now has support for using <a
href="https://github.com/cyphar/libpathrs">libpathrs</a> as a backend.
This is opt-in and can be enabled at build time with the
<code>libpathrs</code> build
tag. The intention is to allow for downstream libraries and other
projects to</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/cyphar/filepath-securejoin/blob/main/CHANGELOG.md">github.com/cyphar/filepath-securejoin's
changelog</a>.</em></p>
<blockquote>
<h2>[0.6.0] - 2025-11-03</h2>
<blockquote>
<p>By the Power of Greyskull!</p>
</blockquote>
<h3>Breaking</h3>
<ul>
<li>The deprecated <code>MkdirAll</code>, <code>MkdirAllHandle</code>,
<code>OpenInRoot</code>, <code>OpenatInRoot</code> and
<code>Reopen</code> wrappers have been removed. Please switch to using
<code>pathrs-lite</code>
directly.</li>
</ul>
<h3>Added</h3>
<ul>
<li><code>pathrs-lite</code> now has support for using libpathrs as a
backend. This is
opt-in and can be enabled at build time with the <code>libpathrs</code>
build tag. The
intention is to allow for downstream libraries and other projects to
make use
of the pure-Go
<code>github.com/cyphar/filepath-securejoin/pathrs-lite</code> package
and distributors can then opt-in to using <code>libpathrs</code> for the
entire binary
if they wish.</li>
</ul>
<h2>[0.5.1] - 2025-10-31</h2>
<blockquote>
<p>Spooky scary skeletons send shivers down your spine!</p>
</blockquote>
<h3>Changed</h3>
<ul>
<li>
<p><code>openat2</code> can return <code>-EAGAIN</code> if it detects a
possible attack in certain
scenarios (namely if there was a rename or mount while walking a path
with a
<code>..</code> component). While this is necessary to avoid a
denial-of-service in the
kernel, it does require retry loops in userspace.</p>
<p>In previous versions, <code>pathrs-lite</code> would retry
<code>openat2</code> 32 times before
returning an error, but we've received user reports that this limit can
be
hit on systems with very heavy load. In some synthetic benchmarks
(testing
the worst-case of an attacker doing renames in a tight loop on every
core of
a 16-core machine) we managed to get a ~3% failure rate in runc. We have
improved this situation in two ways:</p>
<ul>
<li>
<p>We have now increased this limit to 128, which should be good enough
for
most use-cases without becoming a denial-of-service vector (the number
of
syscalls called by the <code>O_PATH</code> resolver in a typical case is
within the
same ballpark). The same benchmarks show a failure rate of ~0.12% which
(while not zero) is probably sufficient for most users.</p>
</li>
<li>
<p>In addition, we now return a <code>unix.EAGAIN</code> error that is
bubbled up and can
be detected by callers. This means that callers with stricter
requirements
to avoid spurious errors can choose to do their own infinite
<code>EAGAIN</code> retry
loop (though we would strongly recommend users use time-based deadlines
in
such retry loops to avoid potentially unbounded denials-of-service).</p>
</li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/60da611d3eb2d22494ec2b6b746e2b2e89ec25f5"><code>60da611</code></a>
VERSION: release v0.6.0</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/f9f2d4cc149fe7080a8020b9c565fbed71c3766f"><code>f9f2d4c</code></a>
go: bump to cyphar.com/[email protected]</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/954313067f370260b7d561296c1385c094418bde"><code>9543130</code></a>
merge v0.5.x branch into main</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/aa2152d0ccc25de8c27b7d8809287238854e7dbd"><code>aa2152d</code></a>
merge <a
href="https://redirect.github.com/cyphar/filepath-securejoin/issues/78">#78</a>
into cyphar/filepath-securejoin:release-0.5</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/d85ff0a12c725fd3f06001f32dc072b06f9a23bf"><code>d85ff0a</code></a>
VERSION: back to development</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/ee2f5bef456216a77126bade2f72c9e972e17f30"><code>ee2f5be</code></a>
VERSION: release v0.5.1</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/0bbec36d754a3fb56661bf316ca0e78e4ae6f3c1"><code>0bbec36</code></a>
CHANGELOG: mention openat2 retry loop changes</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/8e20ab45cc6bd6931c184d19a56f0a3011bd65d7"><code>8e20ab4</code></a>
CHANGELOG: mention openat2 retry loop changes</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/13b93d7004fd0fae19dd5c30dd0edf86468e53a3"><code>13b93d7</code></a>
merge <a
href="https://redirect.github.com/cyphar/filepath-securejoin/issues/77">#77</a>
into cyphar/filepath-securejoin:release-0.5</li>
<li><a
href="https://github.com/cyphar/filepath-securejoin/commit/b12321d4a64c73105d22cd94d50a9f4caca715d4"><code>b12321d</code></a>
openat2: increase retry count to 128</li>
<li>Additional commits viewable in <a
href="https://github.com/cyphar/filepath-securejoin/compare/v0.5.0...v0.6.0">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
</details>2 files changed
+3
-3
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
6 | | - | |
| 6 | + | |
7 | 7 | | |
8 | 8 | | |
9 | 9 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
15 | | - | |
16 | | - | |
| 15 | + | |
| 16 | + | |
17 | 17 | | |
18 | 18 | | |
19 | 19 | | |
| |||
0 commit comments