[Validate] DiskPath allows path traversal — /dev/../etc/passwd passes validation

[castrojo]

Summary

validate.DiskPath() only checks that the path starts with /dev/ and is longer than 5 characters. It does not reject .. path components, allowing path traversal.

Steps to Reproduce

err := validate.DiskPath("/dev/../etc/passwd")
// err is nil — passes validation

Expected

Paths containing .. should be rejected. The validated path should be within the /dev/ tree.

Actual

func DiskPath(s string) error {
    if !strings.HasPrefix(s, "/dev/") {
        return fmt.Errorf("disk path must start with /dev/")
    }
    if len(s) <= 5 {
        return fmt.Errorf("disk path too short")
    }
    return nil  // no traversal check
}

/dev/../etc/passwd, /dev/./../../tmp/evil, etc. all pass validation.

Impact

The disk path is passed to flatcar-install -d <path>. While flatcar-install would likely reject a non-block-device path, the validation layer should enforce this as defense in depth. If any future code path uses the disk path for file operations (e.g., checking partition table), path traversal could be exploited.

Suggested Fix

if strings.Contains(s, "..") {
    return fmt.Errorf("disk path must not contain \"..\"")
}

Or use filepath.Clean() and re-verify the /dev/ prefix.

Severity

Medium — Defense in depth. The downstream flatcar-install binary likely rejects invalid paths, but the validation layer should not pass them through.

[castrojo]

Fixed in e73780f