Repository navigation
HTTP requests to Ubuntu archive with path traversal in the URL not working in restricted environment #255
Description
When running either chisel cut or chisel debug check-release-archives commands, I receive the following error:
Error: Get "http://archive.ubuntu.com/ubuntu/dists/plucky-updates/../../pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb": EOF
I have found that the issue is caused due to the fact that there is path traversal in the urls being requested from the Ubuntu archive in archive.go, and at my company we have a VPN in place which blocks these types of urls as path traversal is flagged by the VPN as a potential method of attack used to compromise systems.
I've just come up with a minimal example that illustrates my issue:
client := &http.Client{}
// Request with path traversal (is blocked by my company VPN)
req, err := http.NewRequest("GET", "http://archive.ubuntu.com/ubuntu/dists/plucky-updates/../../pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb", nil)
resp, err := client.Do(req)
// Request without path traversal (is not blocked by company VPN)
req, err := http.NewRequest("GET", "http://archive.ubuntu.com/ubuntu/pool/main/a/apparmor/apparmor_4.1.0~beta5-0ubuntu14.2_amd64.deb", nil)
resp, err := client.Do(req)I assume that this isn't an issue for most people, but I believe that there would be no regression if the Ubuntu archive request url is updated to remove the "../" path traversal and instead just contain the resolved url?
Reacted by Hadrien Patte
Activity
letFunny commentedon Nov 21, 2025
@plushie-cat Thank you for filing an issue! We will work on it in #257, it should be very simple to fix.
plushie-cat commentedon Nov 23, 2025
@letFunny thanks very much for the help!
upils commentedon Nov 25, 2025
@plushie-cat would you mind testing the fix in #257 to confirm it solves your issue?
plushie-cat commentedon Nov 25, 2025
@upils sure I'll test it out and get back to you
plushie-cat commentedon Nov 28, 2025
@upils apologies for the delay, I’ve just been a bit busy with other tasks for work but I’ll have a look at this early next week.
plushie-cat commentedon Dec 3, 2025
@upils @letFunny I've tested out the fix and it works!
plushie-cat commentedon Dec 11, 2025
Hello I just wanted to know if there was anything blocking #257 from being merged (and completely understand if there is)? Is there anything more you wanted me to test for this?
upils commentedon Dec 15, 2025
@plushie-cat Thanks for confirming the fix. At this stage it requires an internal review on our side, that will likely only happen after the holiday break.