feat: minor enhancements to /models/apply (#297)

pkg/gallery/models.go

@@ -50,9 +50,9 @@ type Config struct {
 }
 
 type File struct {
-	Filename string `yaml:"filename"`
-	SHA256   string `yaml:"sha256"`
-	URI      string `yaml:"uri"`
+	Filename string `yaml:"filename" json:"filename"`
+	SHA256   string `yaml:"sha256" json:"sha256"`
+	URI      string `yaml:"uri" json:"uri"`
 }
 
 type PromptTemplate struct {
@@ -77,6 +77,21 @@ func ReadConfigFile(filePath string) (*Config, error) {
 	return &config, nil
 }
 
+func inTrustedRoot(path string, trustedRoot string) error {
+	for path != "/" {
+		path = filepath.Dir(path)
+		if path == trustedRoot {
+			return nil
+		}
+	}
+	return fmt.Errorf("path is outside of trusted root")
+}
+
+func verifyPath(path, basePath string) error {
+	c := filepath.Clean(filepath.Join(basePath, path))
+	return inTrustedRoot(c, basePath)
+}
+
 func Apply(basePath, nameOverride string, config *Config) error {
 	// Create base path if it doesn't exist
 	err := os.MkdirAll(basePath, 0755)
@@ -88,6 +103,9 @@ func Apply(basePath, nameOverride string, config *Config) error {
 	for _, file := range config.Files {
 		log.Debug().Msgf("Checking %q exists and matches SHA", file.Filename)
 
+		if err := verifyPath(file.Filename, basePath); err != nil {
+			return err
+		}
 		// Create file path
 		filePath := filepath.Join(basePath, file.Filename)
 
@@ -173,6 +191,9 @@ func Apply(basePath, nameOverride string, config *Config) error {
 
 	// Write prompt template contents to separate files
 	for _, template := range config.PromptTemplates {
+		if err := verifyPath(template.Name+".tmpl", basePath); err != nil {
+			return err
+		}
 		// Create file path
 		filePath := filepath.Join(basePath, template.Name+".tmpl")
 
@@ -195,6 +216,10 @@ func Apply(basePath, nameOverride string, config *Config) error {
 		name = nameOverride
 	}
 
+	if err := verifyPath(name+".yaml", basePath); err != nil {
+		return err
+	}
+
 	configFilePath := filepath.Join(basePath, name+".yaml")
 
 	// Read and update config file as map[string]interface{}