From d8045b95693faf92f227e5f851cc0b06a60ab158 Mon Sep 17 00:00:00 2001
From: liuxu <liuxu156@huawei.com>
Date: Thu, 5 Dec 2024 11:06:32 +0800
Subject: [PATCH] fix CVE-2024-10220

Signed-off-by: liuxu <liuxu156@huawei.com>
(cherry picked from commit 02485f7220d5756b18d1837705923206654482f2)
---
 ...e-directory-must-be-max-1-level-deep.patch | 56 +++++++++++++++++++
 kubernetes.spec                               |  9 ++-
 2 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 0007-gitRepo-volume-directory-must-be-max-1-level-deep.patch

diff --git a/0007-gitRepo-volume-directory-must-be-max-1-level-deep.patch b/0007-gitRepo-volume-directory-must-be-max-1-level-deep.patch
new file mode 100644
index 0000000..1712bd3
--- /dev/null
+++ b/0007-gitRepo-volume-directory-must-be-max-1-level-deep.patch
@@ -0,0 +1,56 @@
+From c7846fd24c16266a3bfd86315171f5b4d5f0c9c9 Mon Sep 17 00:00:00 2001
+From: Imre Rad <imrer@google.com>
+Date: Thu, 25 Apr 2024 14:21:51 +0000
+Subject: [PATCH] gitRepo volume: directory must be max 1 level deep
+
+More details on Hackerone #2266560
+---
+ pkg/volume/git_repo/git_repo.go      |  6 ++++++
+ pkg/volume/git_repo/git_repo_test.go | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/pkg/volume/git_repo/git_repo.go b/pkg/volume/git_repo/git_repo.go
+index 995018d9007..b3827b92ad0 100644
+--- a/pkg/volume/git_repo/git_repo.go
++++ b/pkg/volume/git_repo/git_repo.go
+@@ -261,6 +261,12 @@ func validateVolume(src *v1.GitRepoVolumeSource) error {
+ 	if err := validateNonFlagArgument(src.Directory, "directory"); err != nil {
+ 		return err
+ 	}
++	if (src.Revision != "") && (src.Directory != "") {
++		cleanedDir := filepath.Clean(src.Directory)
++		if strings.Contains(cleanedDir, "/") || (strings.Contains(cleanedDir, "\\")) {
++			return fmt.Errorf("%q is not a valid directory, it must not contain a directory separator", src.Directory)
++		}
++	}
+ 	return nil
+ }
+ 
+diff --git a/pkg/volume/git_repo/git_repo_test.go b/pkg/volume/git_repo/git_repo_test.go
+index 5b1461be892..650f765cc48 100644
+--- a/pkg/volume/git_repo/git_repo_test.go
++++ b/pkg/volume/git_repo/git_repo_test.go
+@@ -267,6 +267,20 @@ func TestPlugin(t *testing.T) {
+ 			},
+ 			isExpectedFailure: true,
+ 		},
++		{
++			name: "invalid-revision-directory-combo",
++			vol: &v1.Volume{
++				Name: "vol1",
++				VolumeSource: v1.VolumeSource{
++					GitRepo: &v1.GitRepoVolumeSource{
++						Repository: gitURL,
++						Revision:   "main",
++						Directory:  "foo/bar",
++					},
++				},
++			},
++			isExpectedFailure: true,
++		},
+ 	}
+ 
+ 	for _, scenario := range scenarios {
+-- 
+2.34.1
+
diff --git a/kubernetes.spec b/kubernetes.spec
index a3fdb42..34559bb 100644
--- a/kubernetes.spec
+++ b/kubernetes.spec
@@ -3,7 +3,7 @@
 
 Name:         kubernetes
 Version:      1.29.1
-Release:      8
+Release:      9
 Summary:      Container cluster management
 License:      ASL 2.0
 URL:          https://k8s.io/kubernetes
@@ -30,6 +30,7 @@ Patch0003: 0003-Add-envFrom-to-serviceaccount-admission-plugin.patch
 Patch0004: 0004-Add-processStartTime-in-metrics-slis.patch
 Patch0005: 0005-fix-a-bug-where-the-uploaded-kubelet-configuration-in-kube-system-kubelet-config-ConfigMap-does-not-respect-user.patch
 Patch0006: 0006-adapt-go-version.patch
+Patch0007: 0007-gitRepo-volume-directory-must-be-max-1-level-deep.patch
 %ifarch riscv64
 Patch1000: 1000-Add-riscv64-support-for-v1.29.1-kubernetes.patch
 %endif
@@ -274,6 +275,12 @@ getent passwd kube >/dev/null || useradd -r -g kube -d / -s /sbin/nologin \
 %systemd_postun kubelet kube-proxy
 
 %changelog
+* Thu Dec 05 2024 liuxu <liuxu156@huawei.com> - 1.29.1-9
+- Type:bugfix
+- CVE:NA
+- SUG:NA
+- DESC:fix CVE-2024-10220
+
 * Thu Nov 28 2024 liuxu <liuxu156@huawei.com> - 1.29.1-8
 - Type:bugfix
 - CVE:NA
-- 
Gitee