donate-cpu-server: do not serve files outside the result path (#8945)

the fallback branch in HttpClientThread.run serves self.resultPath + url
for any GET path that is not a known report, and the path from parse_req
is not normalized. a raw request like `GET /../../../etc/passwd
HTTP/1.1` (browsers collapse the dots, a socket or `curl --path-as-is`
does not) gets back any text file the daca server user can read.
normalize the joined path and answer 404 unless it stays under the
result path, so package results and info_output/ files are served as
before. test_file_outside_result_path in
test/tools/donate_cpu_server_test.py fails without the change. there is
no trac ticket for this yet, please create one or let me know and i will
update the title.

Author: Nussu06

test/tools/donate_cpu_server_test.py

@@ -15,3 +15,32 @@ def test_parse_req():
     _test_parse_req("GET /head-uninitvar?pkgs=1 HTTP/1.1", '/head-uninitvar', {'pkgs': '1'})
     _test_parse_req("GET /crash.html?pkgs=1 HTTP/1.1", '/crash.html', {'pkgs': '1'})
     _test_parse_req("GET /head-uninitvar?pkgs=1&pkgs2=2 HTTP/1.1", '/head-uninitvar', {'pkgs': '1', 'pkgs2': '2'})
+
+class _Connection:
+    def __init__(self):
+        self.data = b''
+
+    def send(self, data):
+        self.data += data
+        return len(data)
+
+    def close(self):
+        pass
+
+def _http_get(result_path, url):
+    conn = _Connection()
+    donate_cpu_server.HttpClientThread(conn, 'GET {} HTTP/1.1'.format(url), str(result_path), []).run()
+    return conn.data.decode('utf-8')
+
+def test_file_outside_result_path(tmp_path):
+    result_path = tmp_path / 'donated-results'
+    result_path.mkdir()
+    (result_path / 'pkg').write_text('result data')
+    (tmp_path / 'secret.txt').write_text('secret data')
+
+    resp = _http_get(result_path, '/pkg')
+    assert resp.startswith('HTTP/1.1 200 OK') and resp.endswith('result data')
+
+    resp = _http_get(result_path, '/../secret.txt')
+    assert resp.startswith('HTTP/1.1 404 Not Found')
+    assert 'secret data' not in resp

tools/donate-cpu-server.py

@@ -1275,8 +1275,9 @@ def run(self):
                 text = clientsReport(self.resultPath)
                 httpGetResponse(self.connection, text, 'text/html')
             else:
-                filename = self.resultPath + url
-                if not os.path.isfile(filename):
+                result_path = os.path.normpath(self.resultPath)
+                filename = os.path.normpath(result_path + url)
+                if os.path.commonpath([result_path, filename]) != result_path or not os.path.isfile(filename):
                     print_ts('HTTP/1.1 404 Not Found')
                     self.connection.send(b'HTTP/1.1 404 Not Found\r\n\r\n')
                 else: