🔐 Sid Gifari File Manager Pro
v8.0.5 | 2026-08-09 23:41:07 | PHP 8.2.33
📂
/ (Root)
/
opt
/
cloudlinux
/
venv
/
lib
/
python3.11
/
site-packages
/
clcagefslib
/
webisolation
/
__pycache__
📍 /opt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/__pycache__
🔄 Refresh
✏️
Editing: docroot_validation.cpython-311.pyc
Read Only
� �9Vj � �Z � d Z ddlmZ ddlZddlZ ej d� � ZdZd d �Zd d �Z dS )ab Trust-boundary validation for panel-supplied document root strings. The docroot value originates from the hosting panel (cPanel / DirectAdmin / Plesk) and is consumed by privileged code that writes jail.c mount configuration files read by root. The jail.c mount syntax is whitespace-delimited (MountEntry.render in mount_types.py joins source/target/options with spaces) and section headers are bracketed (`[<docroot>]` in jail_config.MountConfig.render), so any whitespace, control character, newline, or bracket inside the docroot corrupts the parser. A sibling module already rejects newlines/carriage-returns on the analogous crontab write path (crontab/libhooks.py and crontab/parser.py); this module is the equivalent guard for the jail mount config write path. Validation is centralized at the trust boundary - call sites are `enable_website_isolation` (where a tenant-owned domain is resolved to a docroot for the first time) and `write_jail_mounts_config` (where the docroot map is re-read from the panel for every regeneration). The helper raises ValueError on rejection, matching the sibling crontab pattern. � )� annotationsNz^/[A-Za-z0-9_./-]*$i �docroot�str�returnc � � t | t � � st d| ��� � �| st d� � �t | � � t k r*t dt | � � � dt � d| ��� � �| � d� � st d| ��� � �t � | � � st d| ��� � �| � d� � D ]}|d k rt d | ��� � ��| S ) a1 Validate a panel-supplied document root before it reaches the jail mount config writer. Args: docroot: Document root string returned by the panel (e.g. from ``clcommon.cpapi.docroot`` or ``clcommon.cpapi.userdomains``). Returns: The validated docroot string, unchanged. Raises: ValueError: If the docroot is empty, not an absolute path, too long, contains a path-traversal segment, or contains any character outside the strict allowlist (alnum, `_`, `-`, `.`, `/`). z Invalid docroot (not a string): z Invalid docroot: empty stringzInvalid docroot (length z exceeds �): �/z Invalid docroot (not absolute): z)Invalid docroot (disallowed characters): z..z$Invalid docroot (parent traversal): ) � isinstancer � ValueError�len�_DOCROOT_MAX_LEN� startswith�_DOCROOT_ALLOWED_RE�match�split)r �segments �_opt/cloudlinux/venv/lib/python3.11/site-packages/clcagefslib/webisolation/docroot_validation.py�validate_docrootr 3 s3 � �" �g�s� #� #� I��G�G�G�G�H�H�H� � :��8�9�9�9� �7�|�|�&�&�&�� ^�s�7�|�|� ^� ^�>N� ^� ^�SZ� ^� ^� � � � � � �c� "� "� I��G�G�G�G�H�H�H� � $� $�W� -� -� R��P�W�P�P�Q�Q�Q� �=�=��%�%� Q� Q�� �d�?�?� � O�G� O� O�P�P� P� � �N� �allowed_prefixc �J � t j � | d�� � }t j � |d�� � }n(# t $ r}t d|� d| ��� � |�d}~ww xY w||k r0|� |dz � � st d|�d|�d| ��� � �| S ) a� Reject a docroot whose on-disk path escapes ``allowed_prefix``. The lexical ``validate_docroot`` above pins the *string shape* of a panel-supplied docroot, but the value still flows verbatim into jail.c mount-line ``source`` fields and is later consumed by a root-run mount executor that calls ``bind(2)``. Per Linux mount(2) semantics, MS_BIND on a symlinked source dereferences the symlink and bind-mounts the resolved path - which lets a tenant who can write anywhere along the docroot's ancestor chain (typically ``/home/<user>/public_html/<sub>`` on cPanel / DA / Plesk) pre-aim the bind source at an arbitrary host path (``ln -s / /home/<user>/public_html/evil``). The root-run jail then happily bind-mounts ``/`` (or any other operator path the tenant chose) inside the tenant's isolated namespace, exposing ``/etc/shadow``, other tenants' homes, etc. The fix shape is the playbook's ``realpath() + assert the resolved path begins with the allowed prefix``: canonicalise both the docroot and the allowed prefix (so a benign operator-installed symlink like ``/home -> /home2`` does not produce a false reject), then require that the resolved docroot stays under the resolved prefix. A tenant-planted symlink aimed outside the home tree (``/home/u/public_html/evil -> /``) resolves to ``/``, which is not a descendant of the user's resolved home and is rejected. The sibling ``create_overlay_storage_directory`` already takes the equivalent O_NOFOLLOW component-walk stance (see ``py/clcagefslib/webisolation/jail_utils.py``); this is the docroot-side analogue called at the same trust boundary as ``validate_docroot``. Args: docroot: Document root string returned by the panel. Must already have passed the lexical ``validate_docroot`` check (so it is absolute, ``..``-free, and within the character allowlist) - this function does *not* re-run those checks. allowed_prefix: Absolute path the resolved docroot must be inside. Typically the user's home directory; passing the unresolved value is fine because the function canonicalises it too. Returns: The docroot string, unchanged. Raises: ValueError: If the resolved docroot escapes the resolved ``allowed_prefix``, or if either path cannot be canonicalised (e.g. because of an OS error other than ENOENT). F)�strictz!Invalid docroot (cannot resolve: r Nr z Invalid docroot (resolves to z outside allowed prefix )�os�path�realpath�OSErrorr r )r r �resolved_docroot�resolved_prefix�excs r � validate_docroot_no_symlinksr [ s� � �r� �7�+�+�G�E�+�B�B�� �'�*�*�>�%�*�H�H���� � � � �� C�� C� C�� C� C� � �� ��������� �?�*�*�3C�3N�3N��#� �4� 4�*� � @�,<� @� @� -� @� @�4;� @� @� � � � �Ns �AA � A*�A%�%A*)r r r r )r r r r r r ) �__doc__� __future__r r �re�compiler r r r � r r �<module>r& s� ��� �, #� "� "� "� "� "� � � � � � � � � !�b�j�!7�8�8� � � �%� %� %� %�PL� L� L� L� L� Lr
💾 Save Changes
❌ Cancel