{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/122276136","pull_request_review_id":44378700,"id":122276136,"diff_hunk":"@@ -53,3 +57,15 @@ func checkMountOption(pv *api.PersistentVolume) field.ErrorList {\n \t}\n \treturn allErrs\n }\n+\n+// ValidatePathNoBacksteps will make sure the targetPath does not have any element which is \"..\"\n+func ValidatePathNoBacksteps(targetPath string) error {\n+\tparts := strings.Split(targetPath, string(os.PathSeparator))","path":"pkg/volume/validation/pv_validation.go","position":18,"original_position":18,"commit_id":"5c4d4992b6cdc33fdf1b4e1b5cd9cdc996b2d9a0","original_commit_id":"b5f264247f855670fda16e9fcee84b151c1ca51d","user":{"login":"bsteciuk","id":49282,"avatar_url":"https://avatars2.githubusercontent.com/u/49282?v=3","gravatar_id":"","url":"https://api.github.com/users/bsteciuk","html_url":"https://github.com/bsteciuk","followers_url":"https://api.github.com/users/bsteciuk/followers","following_url":"https://api.github.com/users/bsteciuk/following{/other_user}","gists_url":"https://api.github.com/users/bsteciuk/gists{/gist_id}","starred_url":"https://api.github.com/users/bsteciuk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsteciuk/subscriptions","organizations_url":"https://api.github.com/users/bsteciuk/orgs","repos_url":"https://api.github.com/users/bsteciuk/repos","events_url":"https://api.github.com/users/bsteciuk/events{/privacy}","received_events_url":"https://api.github.com/users/bsteciuk/received_events","type":"User","site_admin":false},"body":"@jhorwit2 @michmike \r\n\r\nI haven't tested out hostPath volume mounts on Windows yet, though it seems like a reasonable strategy for splitting up the path.  I did find a path that looks like it would slip through though. \r\n\r\nAccording to https://en.wikipedia.org/wiki/Path_(computing)#MS-DOS.2FMicrosoft_Windows_style  \r\n```C:..\\File.txt``` is a valid path, which points to a file called File.txt located in the parent directory of the current directory on drive C:.\r\n\r\nI don't know what the current working directory would be here, but this seems like a case that would have to be checked for.\r\n\r\nThis small snippet shows it in action, as well as show the first segment which performs the backstepping, though would not be caught by the validation.\r\n\r\n```\r\npackage main\r\n\r\nimport \"fmt\"\r\nimport \"os\"\r\nimport \"path/filepath\" \r\nimport \"strings\"\r\n\r\nfunc main() {\r\n\tpath := \"C:..\\\\test.file\"\r\n\tos.Create(path)\r\n\tfmt.Println(strings.Split(filepath.ToSlash(path),\"/\")[0])\r\n}\r\n\r\n```\r\nThe output to stdout is:\r\n```C:..```\r\n\r\nIf the binary is located in ```C:\\Users\\bsteciuk\\go\\src\\test\\main.exe``` and I run it from ```C:\\Users\\bsteciuk\\go\\```, then it will create the file ```C:\\Users\\bsteciuk\\test.file```","created_at":"2017-06-15T18:22:40Z","updated_at":"2017-06-15T18:22:41Z","html_url":"https://github.com/kubernetes/kubernetes/pull/47290#discussion_r122276136","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments/122276136"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/47290#discussion_r122276136"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290","id":124993885,"html_url":"https://github.com/kubernetes/kubernetes/pull/47290","diff_url":"https://github.com/kubernetes/kubernetes/pull/47290.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/47290.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/47290","number":47290,"state":"open","locked":false,"title":"WIP validate host paths on the kubelet for backsteps","user":{"login":"jhorwit2","id":3876739,"avatar_url":"https://avatars2.githubusercontent.com/u/3876739?v=3","gravatar_id":"","url":"https://api.github.com/users/jhorwit2","html_url":"https://github.com/jhorwit2","followers_url":"https://api.github.com/users/jhorwit2/followers","following_url":"https://api.github.com/users/jhorwit2/following{/other_user}","gists_url":"https://api.github.com/users/jhorwit2/gists{/gist_id}","starred_url":"https://api.github.com/users/jhorwit2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhorwit2/subscriptions","organizations_url":"https://api.github.com/users/jhorwit2/orgs","repos_url":"https://api.github.com/users/jhorwit2/repos","events_url":"https://api.github.com/users/jhorwit2/events{/privacy}","received_events_url":"https://api.github.com/users/jhorwit2/received_events","type":"User","site_admin":false},"body":"<!--  Thanks for sending a pull request!  Here are some tips for you:\r\n1. If this is your first time, read our contributor guidelines https://git.k8s.io/community/contributors/devel/pull-requests.md#the-pr-submit-process and developer guide https://git.k8s.io/community/contributors/devel/development.md#development-guide\r\n2. If you want *faster* PR reviews, read how: https://git.k8s.io/community/contributors/devel/pull-requests.md#best-practices-for-faster-reviews\r\n3. Follow the instructions for writing a release note: https://git.k8s.io/community/contributors/devel/pull-requests.md#write-release-notes-if-needed\r\n-->\r\n\r\n**What this PR does / why we need it**:\r\n\r\nThis PR adds validation on the kubelet to ensure the host path does not contain backsteps that could allow the volume to escape the PSP's allowed host paths. Currently, there is validation done at in API server; however, that does not account for mismatch of OS's on the kubelet vs api server. \r\n\r\n**Which issue this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close that issue when PR gets merged)*: fixes #47107\r\n\r\n**Special notes for your reviewer**:\r\n\r\ncc @liggitt\r\n\r\n**Release note**:\r\n<!--  Steps to write your release note:\r\n1. Use the release-note-* labels to set the release note state (if you have access)\r\n2. Enter your extended release note in the below block; leaving it blank means using the PR title as the release note. If no release note is required, just write `NONE`.\r\n-->\r\n\r\n```release-note\r\nPaths containing backsteps (for example, \"../bar\") are no longer allowed in hostPath volume paths, or in volumeMount subpaths\r\n```\r\n","created_at":"2017-06-10T15:10:46Z","updated_at":"2017-06-15T18:22:41Z","closed_at":null,"merged_at":null,"merge_commit_sha":"cdb3eaf9de9d8c34653d8db46700d40c6574c43e","assignee":{"login":"saad-ali","id":10052848,"avatar_url":"https://avatars2.githubusercontent.com/u/10052848?v=3","gravatar_id":"","url":"https://api.github.com/users/saad-ali","html_url":"https://github.com/saad-ali","followers_url":"https://api.github.com/users/saad-ali/followers","following_url":"https://api.github.com/users/saad-ali/following{/other_user}","gists_url":"https://api.github.com/users/saad-ali/gists{/gist_id}","starred_url":"https://api.github.com/users/saad-ali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saad-ali/subscriptions","organizations_url":"https://api.github.com/users/saad-ali/orgs","repos_url":"https://api.github.com/users/saad-ali/repos","events_url":"https://api.github.com/users/saad-ali/events{/privacy}","received_events_url":"https://api.github.com/users/saad-ali/received_events","type":"User","site_admin":false},"assignees":[{"login":"saad-ali","id":10052848,"avatar_url":"https://avatars2.githubusercontent.com/u/10052848?v=3","gravatar_id":"","url":"https://api.github.com/users/saad-ali","html_url":"https://github.com/saad-ali","followers_url":"https://api.github.com/users/saad-ali/followers","following_url":"https://api.github.com/users/saad-ali/following{/other_user}","gists_url":"https://api.github.com/users/saad-ali/gists{/gist_id}","starred_url":"https://api.github.com/users/saad-ali/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saad-ali/subscriptions","organizations_url":"https://api.github.com/users/saad-ali/orgs","repos_url":"https://api.github.com/users/saad-ali/repos","events_url":"https://api.github.com/users/saad-ali/events{/privacy}","received_events_url":"https://api.github.com/users/saad-ali/received_events","type":"User","site_admin":false}],"requested_reviewers":[],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/32","html_url":"https://github.com/kubernetes/kubernetes/milestone/32","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones/32/labels","id":2264750,"number":32,"title":"v1.7","description":"","creator":{"login":"pwittrock","id":7882754,"avatar_url":"https://avatars3.githubusercontent.com/u/7882754?v=3","gravatar_id":"","url":"https://api.github.com/users/pwittrock","html_url":"https://github.com/pwittrock","followers_url":"https://api.github.com/users/pwittrock/followers","following_url":"https://api.github.com/users/pwittrock/following{/other_user}","gists_url":"https://api.github.com/users/pwittrock/gists{/gist_id}","starred_url":"https://api.github.com/users/pwittrock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pwittrock/subscriptions","organizations_url":"https://api.github.com/users/pwittrock/orgs","repos_url":"https://api.github.com/users/pwittrock/repos","events_url":"https://api.github.com/users/pwittrock/events{/privacy}","received_events_url":"https://api.github.com/users/pwittrock/received_events","type":"User","site_admin":false},"open_issues":112,"closed_issues":790,"state":"open","created_at":"2017-01-19T17:41:27Z","updated_at":"2017-06-15T18:10:26Z","due_on":"2017-06-28T07:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/47290/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/5c4d4992b6cdc33fdf1b4e1b5cd9cdc996b2d9a0","head":{"label":"jhorwit2:jah/hostpath-psp-backstep-check","ref":"jah/hostpath-psp-backstep-check","sha":"5c4d4992b6cdc33fdf1b4e1b5cd9cdc996b2d9a0","user":{"login":"jhorwit2","id":3876739,"avatar_url":"https://avatars2.githubusercontent.com/u/3876739?v=3","gravatar_id":"","url":"https://api.github.com/users/jhorwit2","html_url":"https://github.com/jhorwit2","followers_url":"https://api.github.com/users/jhorwit2/followers","following_url":"https://api.github.com/users/jhorwit2/following{/other_user}","gists_url":"https://api.github.com/users/jhorwit2/gists{/gist_id}","starred_url":"https://api.github.com/users/jhorwit2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhorwit2/subscriptions","organizations_url":"https://api.github.com/users/jhorwit2/orgs","repos_url":"https://api.github.com/users/jhorwit2/repos","events_url":"https://api.github.com/users/jhorwit2/events{/privacy}","received_events_url":"https://api.github.com/users/jhorwit2/received_events","type":"User","site_admin":false},"repo":{"id":77235466,"name":"kubernetes","full_name":"jhorwit2/kubernetes","owner":{"login":"jhorwit2","id":3876739,"avatar_url":"https://avatars2.githubusercontent.com/u/3876739?v=3","gravatar_id":"","url":"https://api.github.com/users/jhorwit2","html_url":"https://github.com/jhorwit2","followers_url":"https://api.github.com/users/jhorwit2/followers","following_url":"https://api.github.com/users/jhorwit2/following{/other_user}","gists_url":"https://api.github.com/users/jhorwit2/gists{/gist_id}","starred_url":"https://api.github.com/users/jhorwit2/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jhorwit2/subscriptions","organizations_url":"https://api.github.com/users/jhorwit2/orgs","repos_url":"https://api.github.com/users/jhorwit2/repos","events_url":"https://api.github.com/users/jhorwit2/events{/privacy}","received_events_url":"https://api.github.com/users/jhorwit2/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/jhorwit2/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":true,"url":"https://api.github.com/repos/jhorwit2/kubernetes","forks_url":"https://api.github.com/repos/jhorwit2/kubernetes/forks","keys_url":"https://api.github.com/repos/jhorwit2/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/jhorwit2/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/jhorwit2/kubernetes/teams","hooks_url":"https://api.github.com/repos/jhorwit2/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/jhorwit2/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/jhorwit2/kubernetes/events","assignees_url":"https://api.github.com/repos/jhorwit2/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/jhorwit2/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/jhorwit2/kubernetes/tags","blobs_url":"https://api.github.com/repos/jhorwit2/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/jhorwit2/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/jhorwit2/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/jhorwit2/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/jhorwit2/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/jhorwit2/kubernetes/languages","stargazers_url":"https://api.github.com/repos/jhorwit2/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/jhorwit2/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/jhorwit2/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/jhorwit2/kubernetes/subscription","commits_url":"https://api.github.com/repos/jhorwit2/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/jhorwit2/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/jhorwit2/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/jhorwit2/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/jhorwit2/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/jhorwit2/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/jhorwit2/kubernetes/merges","archive_url":"https://api.github.com/repos/jhorwit2/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/jhorwit2/kubernetes/downloads","issues_url":"https://api.github.com/repos/jhorwit2/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/jhorwit2/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/jhorwit2/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/jhorwit2/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/jhorwit2/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/jhorwit2/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/jhorwit2/kubernetes/deployments","created_at":"2016-12-23T15:51:34Z","updated_at":"2016-12-23T15:52:17Z","pushed_at":"2017-06-14T00:45:39Z","git_url":"git://github.com/jhorwit2/kubernetes.git","ssh_url":"git@github.com:jhorwit2/kubernetes.git","clone_url":"https://github.com/jhorwit2/kubernetes.git","svn_url":"https://github.com/jhorwit2/kubernetes","homepage":"http://kubernetes.io","size":444963,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"0a1b7d94b441da381eb30c4890bb509771638f8c","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":20580498,"name":"kubernetes","full_name":"kubernetes/kubernetes","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars1.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes","description":"Production-Grade Container Scheduling and Management","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes","forks_url":"https://api.github.com/repos/kubernetes/kubernetes/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes/deployments","created_at":"2014-06-06T22:56:04Z","updated_at":"2017-06-15T16:39:59Z","pushed_at":"2017-06-15T18:13:27Z","git_url":"git://github.com/kubernetes/kubernetes.git","ssh_url":"git@github.com:kubernetes/kubernetes.git","clone_url":"https://github.com/kubernetes/kubernetes.git","svn_url":"https://github.com/kubernetes/kubernetes","homepage":"http://kubernetes.io","size":665111,"stargazers_count":24033,"watchers_count":24033,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":8516,"mirror_url":null,"open_issues_count":5138,"forks":8516,"open_issues":5138,"watchers":24033,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290"},"html":{"href":"https://github.com/kubernetes/kubernetes/pull/47290"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/47290"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/issues/47290/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes/pulls/47290/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes/statuses/5c4d4992b6cdc33fdf1b4e1b5cd9cdc996b2d9a0"}}}}
{"actor":{"display_login":"bsteciuk"}}