From 14aa25f7151b48ec625ac8eaf8390bfe20107e52 Mon Sep 17 00:00:00 2001
From: Sudipta Pandit <sudpandit@microsoft.com>
Date: Tue, 7 Jan 2025 18:29:24 +0530
Subject: [PATCH] Fix CVE-2024-10220 for kubernetes

---
 SPECS/kubernetes/CVE-2024-10220.patch | 53 +++++++++++++++++++++++++++
 SPECS/kubernetes/kubernetes.spec      |  6 ++-
 2 files changed, 58 insertions(+), 1 deletion(-)
 create mode 100644 SPECS/kubernetes/CVE-2024-10220.patch

diff --git a/SPECS/kubernetes/CVE-2024-10220.patch b/SPECS/kubernetes/CVE-2024-10220.patch
new file mode 100644
index 00000000000..825b3db97dd
--- /dev/null
+++ b/SPECS/kubernetes/CVE-2024-10220.patch
@@ -0,0 +1,53 @@
+From 6622b002f70a153100d1c286fbcea721160da192 Mon Sep 17 00:00:00 2001
+From: Imre Rad <imrer@google.com>
+Date: Thu, 25 Apr 2024 14:21:51 +0000
+Subject: [PATCH] gitRepo volume: directory must be max 1 level deep
+
+More details on Hackerone #2266560
+---
+ pkg/volume/git_repo/git_repo.go      |  6 ++++++
+ pkg/volume/git_repo/git_repo_test.go | 14 ++++++++++++++
+ 2 files changed, 20 insertions(+)
+
+diff --git a/pkg/volume/git_repo/git_repo.go b/pkg/volume/git_repo/git_repo.go
+index 995018d900727..b3827b92ad0f0 100644
+--- a/pkg/volume/git_repo/git_repo.go
++++ b/pkg/volume/git_repo/git_repo.go
+@@ -261,6 +261,12 @@ func validateVolume(src *v1.GitRepoVolumeSource) error {
+ 	if err := validateNonFlagArgument(src.Directory, "directory"); err != nil {
+ 		return err
+ 	}
++	if (src.Revision != "") && (src.Directory != "") {
++		cleanedDir := filepath.Clean(src.Directory)
++		if strings.Contains(cleanedDir, "/") || (strings.Contains(cleanedDir, "\\")) {
++			return fmt.Errorf("%q is not a valid directory, it must not contain a directory separator", src.Directory)
++		}
++	}
+ 	return nil
+ }
+ 
+diff --git a/pkg/volume/git_repo/git_repo_test.go b/pkg/volume/git_repo/git_repo_test.go
+index 5b1461be892a1..650f765cc4884 100644
+--- a/pkg/volume/git_repo/git_repo_test.go
++++ b/pkg/volume/git_repo/git_repo_test.go
+@@ -267,6 +267,20 @@ func TestPlugin(t *testing.T) {
+ 			},
+ 			isExpectedFailure: true,
+ 		},
++		{
++			name: "invalid-revision-directory-combo",
++			vol: &v1.Volume{
++				Name: "vol1",
++				VolumeSource: v1.VolumeSource{
++					GitRepo: &v1.GitRepoVolumeSource{
++						Repository: gitURL,
++						Revision:   "main",
++						Directory:  "foo/bar",
++					},
++				},
++			},
++			isExpectedFailure: true,
++		},
+ 	}
+ 
+ 	for _, scenario := range scenarios {
diff --git a/SPECS/kubernetes/kubernetes.spec b/SPECS/kubernetes/kubernetes.spec
index 3b018cc3b52..c05e0848884 100644
--- a/SPECS/kubernetes/kubernetes.spec
+++ b/SPECS/kubernetes/kubernetes.spec
@@ -10,7 +10,7 @@
 Summary:        Microsoft Kubernetes
 Name:           kubernetes
 Version:        1.28.4
-Release:        12%{?dist}
+Release:        13%{?dist}
 License:        ASL 2.0
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -24,6 +24,7 @@ Patch2:         CVE-2023-5408.patch
 Patch3:         CVE-2023-45288.patch
 Patch4:         CVE-2024-28180.patch
 Patch5:         CVE-2024-24786.patch
+Patch6:         CVE-2024-10220.patch
 BuildRequires:  flex-devel
 BuildRequires:  glibc-static >= 2.35-7%{?dist}
 BuildRequires:  golang
@@ -270,6 +271,9 @@ fi
 %{_exec_prefix}/local/bin/pause
 
 %changelog
+* Tue Jan 07 2025 Sudipta Pandit <sudpandit@microsoft.com> - 1.28.4-13
+- Add patch for CVE-2024-10220
+
 * Mon Oct 14 2024 Henry Li <lihl@microsoft.com> - 1.28.4-12
 - Add patch to resolve CVE-2024-24786