search

jupyterhub / nbgitpuller

Jupyter server extension to sync a git repository one-way to a local path
https://nbgitpuller.readthedocs.io
BSD 3-Clause "New" or "Revised" License
212 stars 86 forks source link

Default to not accepting the creation of `.` prefixed folders? #330

Open consideRatio opened 1 year ago

consideRatio commented 1 year ago

I think having nbgitpuller create folders prefixed with . isn't relevant enough to be enabled by default for securiyt reasons. I think its a relatively easy way to create exploits if someone is baited to clicking a malicious nbgitpuller link.

Should we add configuration to make it disabled by default, forcing it to be made opt-in?

mathbunnyru commented 1 year ago

I'm so sorry, I haven't used nbgitpuller, can it create files in the home dir?

For example, can it create .bashrc in the /home/jovyan/? Unfortunately, .bashrc might be sometimes missing in our images (because of mounting volumes and user renaming), so if this file can be created by nbgitpuller, it makes this vulnerability even worse.

consideRatio commented 1 year ago

It can't i think initialize a file directly, but folders can be initialized with files in it.

manics commented 1 year ago

Also worth noting that targetPath can be set to an arbitrary absolute or relative path, overriding the default git folder name, and allowing creation of directories outside the working directory. If for example you mounted an new empty volume to /home/jovyan, you could set targetPath=/home/jovyan.

mathbunnyru commented 1 year ago

Also worth noting that targetPath can be set to an arbitrary absolute or relative path, overriding the default git folder name, and allowing creation of directories outside the working directory. If for example you mounted an new empty volume to /home/jovyan, you could set targetPath=/home/jovyan.

That's really unfortunate because this sounds even more dangerous now.