#490 #491: posix storage on os.Root; tus uploads owner-bound #501

Merged

Cordy merged 5 commits from fix-490-491 into main

2026-09-12 15:25:19 +00:00

Cordy commented

2026-09-12 15:23:08 +00:00

Owner

Security wave 1 of the #490–#498 hardening set.

#490: the posix driver is rebuilt on os.Root — the kernel refuses any resolution leaving the storage root, symlinks included. Policy: links are not data — never listed, Stat/Open/Copy on a link answer ErrNotFound, escape errors map to not-found so nothing is leaked. SizeByPrefix now walks through the driver's own List so the same policy applies. Tests: out-of-root file link, out-of-root dir link mid-path, in-root link (all refused), real file still served.
#491: tus uploads record their creator (Owner in the sidecar); HEAD/PATCH/DELETE from any other user answer the same 404 as an unknown id, so completion always runs in the creator's scope. Pre-upgrade ownerless sidecars are inert — no authenticated user can claim them (noted in CHANGELOG). Tests: two-user access matrix + ownerless-sidecar inertness; the existing unauthenticated restart-recovery test stays valid because both sides resolve to the empty owner only when no auth middleware is present.

Witnessed red on the runner for all five new tests before implementation; full suite green.

Security wave 1 of the #490–#498 hardening set. - **#490**: the posix driver is rebuilt on `os.Root` — the kernel refuses any resolution leaving the storage root, symlinks included. Policy: links are not data — never listed, `Stat`/`Open`/`Copy` on a link answer `ErrNotFound`, escape errors map to not-found so nothing is leaked. `SizeByPrefix` now walks through the driver's own `List` so the same policy applies. Tests: out-of-root file link, out-of-root dir link mid-path, in-root link (all refused), real file still served. - **#491**: tus uploads record their creator (`Owner` in the sidecar); HEAD/PATCH/DELETE from any other user answer the same 404 as an unknown id, so completion always runs in the creator's scope. Pre-upgrade ownerless sidecars are inert — no authenticated user can claim them (noted in CHANGELOG). Tests: two-user access matrix + ownerless-sidecar inertness; the existing unauthenticated restart-recovery test stays valid because both sides resolve to the empty owner only when no auth middleware is present. Witnessed red on the runner for all five new tests before implementation; full suite green.

Cordy added 5 commits

2026-09-12 15:23:10 +00:00