Skip to content

[draft]: Migrate filesystem to os.Root to mitigate TOCTOU filesystem attacks and remove need for own maintained code#306

Open
DaneEveritt wants to merge 30 commits intodevelopfrom
dane/fs
Open

[draft]: Migrate filesystem to os.Root to mitigate TOCTOU filesystem attacks and remove need for own maintained code#306
DaneEveritt wants to merge 30 commits intodevelopfrom
dane/fs

Conversation

@DaneEveritt
Copy link
Copy Markdown
Member

@DaneEveritt DaneEveritt commented Feb 19, 2026

Note

This PR is open for review and will remain so for a little bit to allow others to browse through the code and try to break things. If you test this PR and come across issues, please leave review feedback.

This is a significant change to the filesystem handling code and there was a lot of work that went into it. Things are guaranteed to break in unexpected ways. Please try to break it.

https://go.dev/blog/osroot

This PR seeks to address long-standing maintenance burdens by shifting from home-rolled filesystem logic to logic maintained, tested, and reviewed by the official Go library. Rather than home rolling the filesystem and copying a lot of internal code this PR seeks to replace almost all usage with calls through os.Root which drastically simplifies the library and dramatically reduces the surface area of code we need to understand and maintain.

I took a rather brute force approach to this, fully reverting back to the original filesystem implementation and trying to parse through the changes while doing that. There are some inherent bug fixes that got lost while doing this. I am still working through reviewing everything to make sure any fixes are properly re-captured in this work.

Comment thread server/backup/backup_local.go Dismissed
Comment thread server/backup/backup_s3.go Dismissed
Comment thread server/server.go Fixed
Comment thread server/server.go Dismissed
Comment thread server/server.go Dismissed
Comment thread environment/settings.go Outdated
Comment thread server/server.go Dismissed
@DaneEveritt DaneEveritt marked this pull request as ready for review February 20, 2026 03:00
@AndyIsHereBoi
Copy link
Copy Markdown

AndyIsHereBoi commented Feb 20, 2026

After testing i have come up with a few things that may/may not be intended
None of these actually crashed wings but many could be fixed by validation in the panel

  • Not passing a path to the edit endpoint returns HTTP 502 from the panel (/files/edit#/)
    read : is a directory

  • Trying to edit a non existing file returns HTTP 500 from the panel (/files/edit#/nonexist.txt)
    openat2 nonexist.txt: file does not exist

  • Trying to view a non existing folder returns HTTP 500 from the panel and continues auto refreshing (/files#/awdwwaac)
    openat2 awdwwaac: file does not exist

  • Trying to download a backup after backup file on disk doesn't exist anymore does return (to browser) {"error":"The requested backup was not found on this server."}

  • Trying to restore a backup that no longer exists on the disk (HTTP 500 from panel):
    stat /var/lib/pterodactyl/backups/4766f180-4cae-4308-940d-6db15e4f34bf.tar.gz: no such file or directory

  • Trying to rename a file from a non existent file ("s" to "c"), only a warning is said but status code is still 204 on the request:
    lstatat s: file does not exist

  • Trying to download a non existent file still returns a download link, but visiting it says
    browser error: {"error":"An unexpected error was encountered while processing this request","request_id":"x"}
    wings error: openat2 c: file does not exist

  • Trying to create a folder starting with ../x.x, even in the panel ui (period required??, panel validation issue?) will error wings saying
    mkdir s.c: not a directory

  • Trying to make a folder with a root of back a folder errors {"root":"../","name":"/c"}:
    safePath ../c: bad path resolution

trying to create a folder with this name:

../../../../c../ccccccccccccccccc<300 more cccc>

says bad request but it still goes through and does not log in activity log

  • Compressing a folder named "cccccccccccccccccccccccccccccccccccccccccccccc.." will display wrong in the activity log (shows as Compressed /{{file}}) (displays correct in detailed view still)
image
  • Trying to rename a file to / is HTTP 500 from panel
    rename .: bad path resolution

  • Panel displays a incorrect path to edit a file starting with \, correctly validated on creation, but not renaming. Panel links to files/edit#//c but needs to be files/edit#/\c

  • Ghost folder made .., created by making a folder called ../§, on files refresh it disappears to be just §

  • This happened yesterday but im unable to recreate: mkdir §: not a directory on the create-directory endpoint to wings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants