Skip to content

Commit

Permalink
Check broken symlinks and don't fail on them unnecessarily
Browse files Browse the repository at this point in the history
Previously, we were using the -f option for the readlink command. This
means that if the symlink was broken (pointing to nonexistent file), the
file path was not evaluated and the readlink command failed which meant
that the git clone task failed as well.

By using the -m option, the symlink path will be evaluated every time.
This means that we will not break builds that contain broken symlinks
pointing to nonexistent files within the directory. However, if the
symlink is pointing to nonexistent file OUTSIDE of the repo, we will
fail the task, as expected to avoid security concerns.

STONEBLD-2492

Signed-off-by: mkosiarc <[email protected]>
  • Loading branch information
mkosiarc committed Jul 1, 2024
1 parent 6b7d639 commit 66b4d49
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion task/git-clone/0.1/git-clone.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,7 @@ spec:
FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=false
while read symlink
do
target=$(readlink -f "$symlink")
target=$(readlink -m "$symlink")
if ! [[ "$target" =~ ^$CHECKOUT_DIR ]]; then
echo "The cloned repository contains symlink pointing outside of the cloned repository: $symlink"
FOUND_SYMLINK_POINTING_OUTSIDE_OF_REPO=true
Expand Down

0 comments on commit 66b4d49

Please sign in to comment.