Skip to content

Contain handler_folder within the build context - #40

Open
welteki wants to merge 3 commits into
openfaas:masterfrom
welteki:fix-handler-folder-containment
Open

welteki wants to merge 3 commits into
openfaas:masterfrom
welteki:fix-handler-folder-containment

Contain extra paths within the build context

467d4eb
Select commit
Loading
Failed to load commit list.
reviewfn / AI Code Review succeeded Sep 8, 2026 in 1m 43s

AI Code Review Results

AI Pull Request Overview

Disclaimer: This review was generated by automated AI and may contain errors. Do not trust its outputs without human verification.

Summary

  • Adds validation for per-function build context paths before RemoveAll runs.
  • Constrains non-dockerfile handler overlays to local paths under the function build context.
  • Reworks extra path copying to use the validated scope-relative destination path.
  • Fixes prefix-sibling path checks by using filepath.Rel and filepath.IsLocal instead of string-prefix matching.
  • Adds unit coverage for traversal, absolute paths, sibling-prefix paths, scope-root rejection, and destination overwrite prevention.

Approval rating (1-10)

9/10. The changes address the scoped path traversal risks with focused validation and relevant regression coverage.

Summary per file

Summary per file
File path Summary
builder/builder.go Validates function names, handler overlays, and extra path destinations before copying.
builder/builder_test.go Adds regression tests for traversal rejection and safe copy destinations.

Overall Assessment

The patch is narrowly targeted and improves the build-context containment model in the areas touched by the PR. The move from prefix checks to filepath.Rel plus filepath.IsLocal closes the sibling-prefix bypass for extra paths, and validating the function build path before os.RemoveAll removes a destructive traversal hazard. The handler overlay check is also applied before directory creation, so rejected overlay paths do not create or overwrite out-of-context destinations. I did not find blocking issues in the scoped diff.

Detailed Review

Detailed Review

No blocking findings.

The changed CreateBuildContext flow validates functionName before constructing and clearing the build directory, which is the right ordering for avoiding traversal-driven deletion outside the configured build directory.

The handlerFolderWithinScope helper uses local-path validation before joining with the build root, so absolute paths and .. escapes are rejected before MkdirAll or handler copying can affect out-of-scope destinations.

The updated pathInScope returns both the absolute source and scope-relative path, which avoids reusing raw extra-path input containing .. segments for destination construction. This closes the destination escape covered by the new regression test.

The added tests exercise the important edge cases introduced by this patch, including sibling-prefix paths, build-context deletion order, rejected handler overlays, and destination placement for accepted extra paths.

AI agent details.

Agent processing time: 1m40.085s
Environment preparation time: 3.246s
Total time from webhook: 1m45.974s