From b4e361e093de8fac751c26276fc25c7edc39cde6 Mon Sep 17 00:00:00 2001
From: Sanne Raymaekers <sanne.raymaekers@gmail.com>
Date: Fri, 1 Mar 2024 13:51:44 +0100
Subject: [PATCH] osbuild-jobsite-builder: unpack source tarball in populate

---
 Makefile                            |  2 ++
 cmd/osbuild-jobsite-builder/main.go | 43 +++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/Makefile b/Makefile
index f04fbdc4f..feb82ab86 100644
--- a/Makefile
+++ b/Makefile
@@ -125,6 +125,8 @@ build: $(BUILDDIR)/bin/
 	go build -o $<osbuild-upload-generic-s3 ./cmd/osbuild-upload-generic-s3/
 	go build -o $<osbuild-mock-openid-provider ./cmd/osbuild-mock-openid-provider
 	go build -o $<osbuild-service-maintenance ./cmd/osbuild-service-maintenance
+	go build -o $<osbuild-jobsite-manager ./cmd/osbuild-jobsite-manager
+	go build -o $<osbuild-jobsite-builder ./cmd/osbuild-jobsite-builder
 	go test -c -tags=integration -o $<osbuild-composer-cli-tests ./cmd/osbuild-composer-cli-tests/main_test.go
 	go test -c -tags=integration -o $<osbuild-weldr-tests ./internal/client/
 	go test -c -tags=integration -o $<osbuild-dnf-json-tests ./cmd/osbuild-dnf-json-tests/main_test.go
diff --git a/cmd/osbuild-jobsite-builder/main.go b/cmd/osbuild-jobsite-builder/main.go
index 5843f339e..35327730d 100644
--- a/cmd/osbuild-jobsite-builder/main.go
+++ b/cmd/osbuild-jobsite-builder/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"archive/tar"
 	"bufio"
 	"bytes"
 	"context"
@@ -12,6 +13,8 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"path/filepath"
+	"strings"
 	"sync"
 	"time"
 
@@ -206,6 +209,46 @@ func (builder *Builder) HandlePopulate(w http.ResponseWriter, r *http.Request) e
 	if r.Method != "POST" {
 		return fmt.Errorf("Builder.HandlePopulate: unexpected request method")
 	}
+	storePath := path.Join(argBuildPath, "store")
+	err := os.Mkdir(storePath, 0755)
+	if err != nil {
+		return fmt.Errorf("Builder.HandlePopulate: failed to make store directory: %v", err)
+	}
+
+	tarReader := tar.NewReader(r.Body)
+	for header, err := tarReader.Next(); err != io.EOF; header, err = tarReader.Next() {
+		if err != nil {
+			return fmt.Errorf("Builder.HandlerPopulate: failed to unpack sources: %v", err)
+		}
+
+		// gosec seems overly zealous here, as the destination gets verified
+		dest := filepath.Join(storePath, header.Name) // #nosec G305
+		if !strings.HasPrefix(dest, filepath.Clean(storePath)) {
+			return fmt.Errorf("Builder.HandlerPopulate: name not clean: %v doesn't have %v prefix", dest, filepath.Clean(storePath))
+		}
+
+		switch header.Typeflag {
+		case tar.TypeDir:
+			if err := os.Mkdir(dest, header.FileInfo().Mode()); err != nil {
+				return fmt.Errorf("Builder.HandlerPopulate: unable to make dir in sources: %v", err)
+			}
+		case tar.TypeReg:
+			file, err := os.Create(dest)
+			if err != nil {
+				return fmt.Errorf("Builder.HandlerPopulate: unable to open file in sources: %v", err)
+			}
+			defer file.Close()
+
+			// the inputs are trusted so ignore G110
+			_, err = io.Copy(file, tarReader) // #nosec G110
+			if err != nil {
+				return fmt.Errorf("Builder.HandlerPopulate: unable to write file in sources: %v", err)
+			}
+			file.Close()
+		default:
+			return fmt.Errorf("Builder.HandlerPopulate: unexpected tar header type: %v", header.Typeflag)
+		}
+	}
 
 	w.WriteHeader(http.StatusOK)