sanitizeLogDirectory returns the absolute path to input when it is a safe "log_directory" for cluster. Otherwise, it returns the absolute path to a good "log_directory" value. https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-DIRECTORY
(cluster *v1beta1.PostgresCluster, input string, recorder record.EventRecorder)
| 57 | // |
| 58 | // https://www.postgresql.org/docs/current/runtime-config-logging.html#GUC-LOG-DIRECTORY |
| 59 | func sanitizeLogDirectory(cluster *v1beta1.PostgresCluster, input string, recorder record.EventRecorder) string { |
| 60 | directory := path.Clean(input) |
| 61 | |
| 62 | // [path.Clean] leaves leading parent directories. Eliminate these as a security measure. |
| 63 | for strings.HasPrefix(directory, "../") { |
| 64 | directory = directory[3:] |
| 65 | } |
| 66 | |
| 67 | switch { |
| 68 | case directory == "log": |
| 69 | // This the Postgres default and the only relative path allowed in v1 of PostgresCluster. |
| 70 | // Expand it relative to the data directory like Postgres does. |
| 71 | return path.Join(DataDirectory(cluster), "log") |
| 72 | |
| 73 | case directory == "", directory == ".", directory == "/", |
| 74 | sensitiveAbsolutePath.MatchString(directory), |
| 75 | sensitiveRelativePath.MatchString(directory): |
| 76 | if recorder != nil { |
| 77 | recorder.Eventf(cluster, corev1.EventTypeWarning, "InvalidParameter", |
| 78 | "Ignoring unsafe Postgres parameter value %q = %q", "log_directory", text.TruncateAt(input, 128)) |
| 79 | } |
| 80 | |
| 81 | // When the value is empty after cleaning or disallowed, choose one instead. |
| 82 | // Keep it on the same volume, if possible. |
| 83 | if strings.HasPrefix(directory, tmpMountPath) { |
| 84 | return path.Join(tmpMountPath, "logs/postgres") |
| 85 | } |
| 86 | if strings.HasPrefix(directory, walMountPath) { |
| 87 | return path.Join(walMountPath, "logs/postgres") |
| 88 | } |
| 89 | |
| 90 | // There is always a data volume, so use that. |
| 91 | return path.Join(dataMountPath, "logs/postgres") |
| 92 | |
| 93 | case !path.IsAbs(directory): |
| 94 | if recorder != nil { |
| 95 | recorder.Eventf(cluster, corev1.EventTypeWarning, "InvalidParameter", |
| 96 | "Postgres parameter %q should be %q or an absolute path", "log_directory", "log") |
| 97 | } |
| 98 | |
| 99 | // Directory is relative. This is disallowed since v1 of PostgresCluster. |
| 100 | // Expand it relative to the data directory like Postgres does. |
| 101 | return path.Join(DataDirectory(cluster), directory) |
| 102 | |
| 103 | default: |
| 104 | // Directory is absolute and considered safe; use it. |
| 105 | return directory |
| 106 | } |
| 107 | } |