Don't use securejoin(templateDir, templateName)

The final filename might be a symlink to somewhere outside `templateDir`
(homebrew). Instead make sure that `templateName` is not using `../`
path references.

Signed-off-by: Jan Dubois <[email protected]>

Author: jandubois

cmd/limactl/start.go

@@ -12,6 +12,7 @@ import (
 	"strings"
 
 	"github.com/containerd/containerd/identifiers"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/lima-vm/lima/cmd/limactl/editflags"
 	"github.com/lima-vm/lima/pkg/editutil"
 	"github.com/lima-vm/lima/pkg/instance"
@@ -118,8 +119,10 @@ func loadOrCreateInstance(cmd *cobra.Command, args []string, createOnly bool) (*
 		return nil, err
 	}
 	if isTemplateURL, templateURL := limatmpl.SeemsTemplateURL(arg); isTemplateURL {
-		// No need to use SecureJoin here. https://github.com/lima-vm/lima/pull/805#discussion_r853411702
-		templateName := filepath.Join(templateURL.Host, templateURL.Path)
+		templateName, err := securejoin.SecureJoin(templateURL.Host, templateURL.Path)
+		if err != nil {
+			return nil, err
+		}
 		switch templateName {
 		case "experimental/vz":
 			logrus.Warn("template://experimental/vz was merged into the default template in Lima v1.0. See also <https://lima-vm.io/docs/config/vmtype/>.")

pkg/limatmpl/locator.go

@@ -18,6 +18,7 @@ import (
 	"unicode"
 
 	"github.com/containerd/containerd/identifiers"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/lima-vm/lima/pkg/ioutilx"
 	"github.com/lima-vm/lima/pkg/limayaml"
 	"github.com/lima-vm/lima/pkg/templatestore"
@@ -40,8 +41,10 @@ func Read(ctx context.Context, name, locator string) (*Template, error) {
 	isTemplateURL, templateURL := SeemsTemplateURL(locator)
 	switch {
 	case isTemplateURL:
-		// No need to use SecureJoin here. https://github.com/lima-vm/lima/pull/805#discussion_r853411702
-		templateName := filepath.Join(templateURL.Host, templateURL.Path)
+		templateName, err := securejoin.SecureJoin(templateURL.Host, templateURL.Path)
+		if err != nil {
+			return nil, err
+		}
 		logrus.Debugf("interpreting argument %q as a template name %q", locator, templateName)
 		if tmpl.Name == "" {
 			// e.g., templateName = "deprecated/centos-7.yaml" , tmpl.Name = "centos-7"

pkg/templatestore/templatestore.go

@@ -14,7 +14,6 @@ import (
 	"strings"
 	"unicode"
 
-	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/lima-vm/lima/pkg/store/dirnames"
 	"github.com/lima-vm/lima/pkg/usrlocalsharelima"
 )
@@ -54,10 +53,7 @@ func Read(name string) ([]byte, error) {
 		name += ".yaml"
 	}
 	for _, templatesDir := range paths {
-		filePath, err := securejoin.SecureJoin(templatesDir, name)
-		if err != nil {
-			return nil, err
-		}
+		filePath := filepath.Join(templatesDir, name)
 		if b, err := os.ReadFile(filePath); !errors.Is(err, os.ErrNotExist) {
 			return b, err
 		}