Confine cleanup and use held session locks

internal/fileops/cleanup.go

@@ -0,0 +1,165 @@
+package fileops
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+)
+
+// RemoveAllUnderRoot removes target and its contents only after opening root and
+// every target ancestor without following symbolic links. target must name a
+// proper descendant of root. Symlinks are rejected rather than followed or
+// removed so a failed cleanup never silently changes its scope.
+func RemoveAllUnderRoot(rootPath, target string) error {
+	root, targetName, err := openConfinedCleanupTarget(rootPath, target)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = root.Close() }()
+	return removeConfinedEntry(root, targetName)
+}
+
+func openConfinedCleanupTarget(rootPath, target string) (*os.Root, string, error) {
+	if strings.TrimSpace(rootPath) == "" {
+		return nil, "", fmt.Errorf("cleanup root is required")
+	}
+	if strings.TrimSpace(target) == "" {
+		return nil, "", fmt.Errorf("cleanup target is required")
+	}
+	rootAbs, err := filepath.Abs(rootPath)
+	if err != nil {
+		return nil, "", fmt.Errorf("resolve cleanup root: %w", err)
+	}
+	targetAbs, err := filepath.Abs(target)
+	if err != nil {
+		return nil, "", fmt.Errorf("resolve cleanup target: %w", err)
+	}
+	relative, err := filepath.Rel(rootAbs, targetAbs)
+	if err != nil {
+		return nil, "", fmt.Errorf("resolve cleanup target below root: %w", err)
+	}
+	if relative == "." || relative == ".." || strings.HasPrefix(relative, ".."+string(filepath.Separator)) {
+		return nil, "", fmt.Errorf("cleanup target %q must be below root %q", targetAbs, rootAbs)
+	}
+	parts, err := relativePathParts(relative)
+	if err != nil {
+		return nil, "", err
+	}
+	root, err := openConfinedDirectory(rootAbs)
+	if err != nil {
+		return nil, "", err
+	}
+	for _, part := range parts[:len(parts)-1] {
+		child, err := openConfinedChild(root, part, false, 0)
+		if err != nil {
+			_ = root.Close()
+			return nil, "", err
+		}
+		_ = root.Close()
+		root = child
+	}
+	return root, parts[len(parts)-1], nil
+}
+
+func openConfinedDirectory(path string) (*os.Root, error) {
+	abs, err := filepath.Abs(path)
+	if err != nil {
+		return nil, fmt.Errorf("resolve directory: %w", err)
+	}
+	parts, err := absolutePathParts(abs)
+	if err != nil {
+		return nil, err
+	}
+	rootPath := filesystemRoot(abs)
+	root, err := os.OpenRoot(rootPath)
+	if err != nil {
+		return nil, fmt.Errorf("open filesystem root %q: %w", rootPath, err)
+	}
+	for _, part := range parts {
+		child, err := openConfinedChild(root, part, false, 0)
+		if err != nil {
+			_ = root.Close()
+			return nil, err
+		}
+		_ = root.Close()
+		root = child
+	}
+	return root, nil
+}
+
+func relativePathParts(path string) ([]string, error) {
+	parts := strings.FieldsFunc(path, func(r rune) bool { return r == filepath.Separator || r == '/' || r == '\\' })
+	if len(parts) == 0 {
+		return nil, fmt.Errorf("cleanup target is required")
+	}
+	for _, part := range parts {
+		if part == "" || part == "." || part == ".." {
+			return nil, fmt.Errorf("unsafe cleanup path component %q", part)
+		}
+	}
+	return parts, nil
+}
+
+func removeConfinedEntry(parent *os.Root, name string) error {
+	info, err := parent.Lstat(name)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("inspect cleanup entry %q: %w", name, err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return fmt.Errorf("refusing to delete symlink path %q", name)
+	}
+	if !info.IsDir() {
+		if err := parent.Remove(name); err != nil {
+			return fmt.Errorf("remove cleanup entry %q: %w", name, err)
+		}
+		return nil
+	}
+
+	child, err := openConfinedChild(parent, name, false, 0)
+	if err != nil {
+		return err
+	}
+	err = removeConfinedChildren(child)
+	closeErr := child.Close()
+	if err != nil {
+		if closeErr != nil {
+			return errors.Join(err, closeErr)
+		}
+		return err
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close cleanup directory %q: %w", name, closeErr)
+	}
+	if err := parent.Remove(name); err != nil {
+		return fmt.Errorf("remove cleanup directory %q: %w", name, err)
+	}
+	return nil
+}
+
+func removeConfinedChildren(root *os.Root) error {
+	directory, err := root.Open(".")
+	if err != nil {
+		return fmt.Errorf("open cleanup directory: %w", err)
+	}
+	entries, readErr := directory.ReadDir(-1)
+	closeErr := directory.Close()
+	if readErr != nil {
+		return fmt.Errorf("read cleanup directory: %w", readErr)
+	}
+	if closeErr != nil {
+		return fmt.Errorf("close cleanup directory: %w", closeErr)
+	}
+	sort.Slice(entries, func(i, j int) bool { return entries[i].Name() < entries[j].Name() })
+	for _, entry := range entries {
+		if err := removeConfinedEntry(root, entry.Name()); err != nil {
+			return err
+		}
+	}
+	return nil
+}