test(controller): add failing tests for unsafe snapshot_tag in create_sandbox

WaylandYang · claude · WaylandYang · commit 424e4a7ac58c · 2026-05-17T18:09:43.000+08:00
Reproduces the path-traversal gap in `create_sandbox`: it skipped
`is_safe_tag` on `req.snapshot_tag`, unlike `delete_snapshot` and
`branch_sandbox` which both validate. A tag like `../../etc/passwd`
falls through to disk-fallback where `snapshot_root.join(tag)`
produces a path whose `../` segments std::fs syscalls resolve outside
snapshot_root. The vmstate-existence check partially gates impact,
but the unvalidated tag also persists into SandboxInfo.snapshot_tag
and later flows into `read_snapshot_volumes`, which parses attacker-
chosen JSON files as forkd_vmm::Snapshot and inherits their volumes
into branches — i.e. attacker controls volume mounts of grandchild
VMs (post-auth, but the K8s manifest's placeholder bearer token
makes that gate brittle in practice).

Two tests added:
- create_sandbox_rejects_unsafe_snapshot_tag_traversal: `../` path
- create_sandbox_rejects_unsafe_snapshot_tag_chars: space char

Both currently FAIL on this commit (returns 404, not 400). The next
commit will add the validation and turn them green. CI logs are the
verification harness — keeping the failing-test commit separate so
the bug-reproduction is recorded in the PR history.

Co-Authored-By: Claude Opus 4.7 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/crates/forkd-controller/src/http.rs b/crates/forkd-controller/src/http.rs
@@ -871,6 +871,53 @@ mod tests {
         assert_eq!(resp.status(), StatusCode::NOT_FOUND);
     }
 
+    #[tokio::test]
+    async fn create_sandbox_rejects_unsafe_snapshot_tag_traversal() {
+        // Regression: `create_sandbox` previously skipped `is_safe_tag` on the
+        // request body's `snapshot_tag`. A traversing value like
+        // `../../etc/passwd` would fall through to the disk-fallback branch
+        // where `snapshot_root.join(tag)` produces a path that std::fs syscalls
+        // resolve outside snapshot_root. The 404-from-vmstate-existence-check
+        // partially limited impact, but the unvalidated tag also got persisted
+        // into SandboxInfo.snapshot_tag and later flowed into
+        // `read_snapshot_volumes`, where it would parse attacker-chosen JSON
+        // files as forkd_vmm::Snapshot and inherit their volumes into branches.
+        //
+        // Expect 400 (input validation), not 404 (file-existence oracle).
+        let app = router(test_state());
+        let resp = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/v1/sandboxes")
+                    .header("content-type", "application/json")
+                    .body(Body::from(r#"{"snapshot_tag":"../../etc/passwd","n":1}"#))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+    }
+
+    #[tokio::test]
+    async fn create_sandbox_rejects_unsafe_snapshot_tag_chars() {
+        // Defense in depth: also reject tags containing characters that aren't
+        // ASCII alnum / dash / underscore (matches `is_safe_tag`'s contract).
+        let app = router(test_state());
+        let resp = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/v1/sandboxes")
+                    .header("content-type", "application/json")
+                    .body(Body::from(r#"{"snapshot_tag":"tag with space","n":1}"#))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::BAD_REQUEST);
+    }
+
     #[tokio::test]
     async fn create_sandbox_rejects_zero_n() {
         let app = router(test_state());
