mirror of
https://github.com/mattermost/mattermost.git
synced 2026-10-16 15:18:10 +08:00
Felipe Martinandcoderabbitai[bot]
abf088ca91
* MM-70595: Enforce log path root behind a feature flag
Log and audit file paths resolving outside the logging root (MM_LOG_PATH,
or the default logs directory) were only logged as an error on config save,
and were never checked at startup at all. Two of the four relevant fields
were not checked even once.
Add the EnforceLogPathRoot feature flag, disabled by default:
- disabled: the path is logged as an error, as before
- enabled: the server refuses to start, and a config save that introduces
such a path is rejected with HTTP 400
Enforcement is a breaking change for deployments with log paths outside the
root and no MM_LOG_PATH set, and was never announced, so it stays opt-in.
The default flips once every supported release carries the flag.
WarnIfLogPathsOutsideRoot is replaced by config.ValidateLogPaths, which
returns an error for the first offending path and knows nothing about the
flag; each caller decides what to do with it. Coverage now spans all four
fields: LogSettings.FileLocation, LogSettings.AdvancedLoggingJSON,
ExperimentalAuditSettings.FileName and
ExperimentalAuditSettings.AdvancedLoggingJSON.
The gate lives in initLogging, before ConfigureLogger opens any target, so
it also covers config reload (which bypasses SaveConfig) and the audit
logger (configured later in the boot sequence). On reload the previously
configured targets are left in place.
Also fix ValidateLogFilePath, which resolved symlinks on the file path but
not on the root. A root containing a symlinked component (/var on macOS, a
symlinked mount) therefore rejected every path inside it, which would block
startup once enforcement is on. Both sides now resolve the deepest existing
ancestor, which additionally catches a symlinked parent directory pointing
out of the root for a not-yet-created file.
* Prevent log path disclosure in config save errors
Log validation details server-side, keep API errors generic, update regression assertions, and clarify that enforcement applies to all System Console config saves.
* Fix check-style and the empty log path save error
mattermost-govet's errorAssertions analyzer rejects assert.Nil on an error,
and AppError.Unwrap returns one:
config_test.go:248:3: calling assert.Nil on error, please use assert.NoError instead
Switch to assert.NoError.
The same change made the AppError generic by dropping its i18n params, but
the translation still interpolated {{.Error}}, so an admin saw the literal
"Invalid logging configuration: <no value>". Replace it with a static
message that keeps the path out of the API response and points at the
server log, where the offending path is now recorded.
* Mention audit paths in the log path save error
ValidateLogPaths checks ExperimentalAuditSettings.FileName and
ExperimentalAuditSettings.AdvancedLoggingJSON alongside the LogSettings
fields, so the save error can be triggered by an audit path alone. Say
"log or audit file path" rather than "log file path".
* Treat advanced logging file target types case-insensitively
logr lowercases target types before building them, so EqualFold is needed
to keep EnforceLogPathRoot from being bypassed with mixed-case "file".
* Rename resolveSymlinkPath to make its missing-path behavior explicit
* Add EnforceLogPathRoot to generated files, support packet golden and i18n description
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>