mirror of
https://github.com/moby/buildkit.git
synced 2026-08-10 01:27:55 +00:00
0c3bb3c7ed
On Windows, RUN --mount=type=cache,source=<subdir> resolved the source
subpath with fs.RootPath, which does not follow Windows reparse points.
A junction placed inside the cache root could therefore point to a path
outside the cache, and the resolved source was mounted into the build
container, exposing host files outside the intended cache subdirectory.
Resolve the real path of both the cache root and the selected source via
GetFinalPathNameByHandle (which follows junctions and symlinks) and reject
any source that resolves outside the cache root.
Add Windows unit tests for the resolver and end-to-end regression tests
for the junction escape (Windows) and the symlink escape (Linux).
Signed-off-by: Dawei Wei <wei.dawei.cn@gmail.com>
(cherry picked from commit 70370e18de3cc7545fcf7f986612a28a803f59d2)
(cherry picked from commit a9155a456b)