admin/felhom-controller
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

R-1126: the gate publishes the container it checked, by id (TOCTOU from the commit's security review)
gates / gates (push) Successful in 42s
Details

Browse Source 
web.SyncFileBrowserMounts can re-create FileBrowser between the check and the connect; a connect by name would publish
the new, unchecked container. The run is now "<id> <StartedAt>" and the connect targets that id.
TestFileBrowserGate_ConnectsTheCheckedContainerById, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
This commit is contained in:
authentik Default Admin
2026-10-17 12:59:43 +02:00
parent 411d7761d9
commit 8f029aa70b
3 changed files with 37 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
controller/internal/stacks/filebrowser_gate.go
+11 -2
View File
@@ -70,15 +70,24 @@ func (m *Manager) joinFileBrowserNetwork() {
// ensureFileBrowserPublic joins FileBrowser to traefik-public only when THIS run was checked and its default login is
// refused. Anything less — the run unknown, not checked yet, the check failed — leaves it unreachable from outside.
//
// TOCTOU (found by the commit's security review, 2026-10-17): the connect targets the CONTAINER ID read with the run,
// never the name — web.SyncFileBrowserMounts can re-create FileBrowser between the check and the connect, and a
// connect by name would publish the new, unchecked container. By id, a replaced container's connect simply fails.
// Pinned by TestFileBrowserGate_ConnectsTheCheckedContainerById.
func (m *Manager) ensureFileBrowserPublic() {
run := m.fbStartedAt()
if run == "" || run != m.fbProbedRun {
return
}
if m.fbNetOn(fileBrowserContainer, traefikNetwork) {
target := fileBrowserContainer // tests' runs carry no id
if f := strings.Fields(run); len(f) == 2 {
target = f[0]
}
if m.fbNetOn(target, traefikNetwork) {
return
}
if err := m.fbNetConnect(fileBrowserContainer, traefikNetwork); err != nil {
if err := m.fbNetConnect(target, traefikNetwork); err != nil {
m.logger.Printf("[WARN] [infra] filebrowser: could not join %s (files.<domain> stays unreachable): %v", traefikNetwork, err)
return
}