search

jupyterhub / nbgitpuller

Jupyter server extension to sync a git repository one-way to a local path
https://nbgitpuller.readthedocs.io
BSD 3-Clause "New" or "Revised" License
205 stars 84 forks source link

Default to not accepting the creation of `.` prefixed folders? #330

Open consideRatio opened 8 months ago

consideRatio commented 8 months ago

I think having nbgitpuller create folders prefixed with . isn't relevant enough to be enabled by default for securiyt reasons. I think its a relatively easy way to create exploits if someone is baited to clicking a malicious nbgitpuller link.

Should we add configuration to make it disabled by default, forcing it to be made opt-in?

mathbunnyru commented 8 months ago

I'm so sorry, I haven't used nbgitpuller, can it create files in the home dir?

For example, can it create .bashrc in the /home/jovyan/? Unfortunately, .bashrc might be sometimes missing in our images (because of mounting volumes and user renaming), so if this file can be created by nbgitpuller, it makes this vulnerability even worse.

consideRatio commented 8 months ago

It can't i think initialize a file directly, but folders can be initialized with files in it.

manics commented 8 months ago

Also worth noting that targetPath can be set to an arbitrary absolute or relative path, overriding the default git folder name, and allowing creation of directories outside the working directory. If for example you mounted an new empty volume to /home/jovyan, you could set targetPath=/home/jovyan.

mathbunnyru commented 8 months ago

Also worth noting that targetPath can be set to an arbitrary absolute or relative path, overriding the default git folder name, and allowing creation of directories outside the working directory. If for example you mounted an new empty volume to /home/jovyan, you could set targetPath=/home/jovyan.

That's really unfortunate because this sounds even more dangerous now.