A cache entry lists the files the task read, as paths relative to the workspace, and vp run checks those files before it uses the entry. For entries from the remote cache, those paths aren't limited to the workspace: an entry can list paths that climb out of it with ...
A corrupted or malicious remote entry can therefore make vp run read and hash any file the user can read, anywhere on the machine, or hang while reading an endless file such as /dev/zero. When several people or CI jobs can write to the same remote cache, any one of them can affect everyone else's runs this way.
It isn't known yet whether normally created entries ever record inputs outside the workspace, which matters for deciding what to reject.
Expected: entries from the remote cache only make vp run read files inside the workspace.
Affects remote cache reads (#756).
A cache entry lists the files the task read, as paths relative to the workspace, and
vp runchecks those files before it uses the entry. For entries from the remote cache, those paths aren't limited to the workspace: an entry can list paths that climb out of it with...A corrupted or malicious remote entry can therefore make
vp runread and hash any file the user can read, anywhere on the machine, or hang while reading an endless file such as/dev/zero. When several people or CI jobs can write to the same remote cache, any one of them can affect everyone else's runs this way.It isn't known yet whether normally created entries ever record inputs outside the workspace, which matters for deciding what to reject.
Expected: entries from the remote cache only make
vp runread files inside the workspace.Affects remote cache reads (#756).