HTTP requests to Ubuntu archive with path traversal in the URL not working in restricted environment

[plushie-cat]

When running either chisel cut or chisel debug check-release-archives commands, I receive the following error:

Error: Get "http://archive.ubuntu.com/ubuntu/dists/plucky-updates/../../pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb": EOF

I have found that the issue is caused due to the fact that there is path traversal in the urls being requested from the Ubuntu archive in archive.go, and at my company we have a VPN in place which blocks these types of urls as path traversal is flagged by the VPN as a potential method of attack used to compromise systems.

I've just come up with a minimal example that illustrates my issue:

client := &http.Client{}

// Request with path traversal (is blocked by my company VPN)
req, err := http.NewRequest("GET", "http://archive.ubuntu.com/ubuntu/dists/plucky-updates/../../pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb", nil)
resp, err := client.Do(req)

// Request without path traversal (is not blocked by company VPN)
req, err := http.NewRequest("GET", "http://archive.ubuntu.com/ubuntu/pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb", nil)
resp, err := client.Do(req)

I assume that this isn't an issue for most people, but I believe that there would be no regression if the Ubuntu archive request url is updated to remove the "../" path traversal and instead just contain the resolved url?

[letFunny]

@plushie-cat Thank you for filing an issue! We will work on it in #257, it should be very simple to fix.

[plushie-cat]

@letFunny thanks very much for the help!

[upils]

@plushie-cat would you mind testing the fix in #257 to confirm it solves your issue?

[plushie-cat]

@upils sure I'll test it out and get back to you

[plushie-cat]

@upils apologies for the delay, I’ve just been a bit busy with other tasks for work but I’ll have a look at this early next week.

[plushie-cat]

@upils @letFunny I've tested out the fix and it works!

[plushie-cat]

Hello I just wanted to know if there was anything blocking #257 from being merged (and completely understand if there is)? Is there anything more you wanted me to test for this?

[upils]

@plushie-cat Thanks for confirming the fix. At this stage it requires an internal review on our side, that will likely only happen after the holiday break.