CVE-2025-22238

@@ -362,6 +362,12 @@ class AuthorizationError(SaltException):
     """
 
 
+class SaltValidationError(SaltException):
+    """
+    Thrown when a value fails validation
+    """
+
+
 class UnsupportedAlgorithm(SaltException):
     """
     Thrown when a requested encryption or signing algorithm is un-supported.

@@ -1197,7 +1197,6 @@ class AESFuncs(TransportMethods):
         "_file_recv",
         "_pillar",
         "_minion_event",
-        "_handle_minion_event",
         "_return",
         "_syndic_return",
         "minion_runner",

@@ -8,6 +8,7 @@
 import glob
 import logging
 import os
+import pathlib
 import shutil
 import time
 
@@ -231,6 +232,8 @@ def save_minions(jid, minions, syndic_id=None):
     """
     Save/update the serialized list of minions for a given job
     """
+    import salt.utils.verify
+
     # Ensure we have a list for Python 3 compatibility
     minions = list(minions)
 
@@ -254,10 +257,20 @@ def save_minions(jid, minions, syndic_id=None):
         else:
             raise
 
-    if syndic_id is not None:
-        minions_path = os.path.join(jid_dir, SYNDIC_MINIONS_P.format(syndic_id))
-    else:
-        minions_path = os.path.join(jid_dir, MINIONS_P)
+    try:
+        if syndic_id is not None:
+            name = SYNDIC_MINIONS_P.format(syndic_id)
+        else:
+            name = MINIONS_P
+        minions_path = salt.utils.verify.clean_join(jid_dir, name)
+        target_name = pathlib.Path(minions_path).resolve().name
+        if name != target_name:
+            raise salt.exceptions.SaltValidationError(
+                f"Filenames do not match: {name} != {target_name}"
+            )
+    except salt.exceptions.SaltValidationError as exc:
+        log.error("Error %s", exc)
+        return
 
     try:
         if not os.path.exists(jid_dir):

@@ -17,7 +17,12 @@
 import salt.utils.platform
 import salt.utils.user
 from salt._logging import LOG_LEVELS
-from salt.exceptions import CommandExecutionError, SaltClientError, SaltSystemExit
+from salt.exceptions import (
+    CommandExecutionError,
+    SaltClientError,
+    SaltSystemExit,
+    SaltValidationError,
+)
 
 # Original Author: Jeff Schroeder <jeffschroeder@computer.org>
 
@@ -502,7 +507,7 @@ def _realpath_windows(path):
 
 def _realpath(path):
     """
-    Cross platform realpath method. On Windows when python 3, this method
+    FCross platform realpath method. On Windows when python 3, this method
     uses the os.readlink method to resolve any filesystem links.
     All other platforms and version use ``os.path.realpath``.
     """
@@ -522,22 +527,33 @@ def clean_path(root, path, subdir=False, realpath=True):
     """
     if not os.path.isabs(root):
         root = os.path.join(os.getcwd(), root)
-    root = os.path.normpath(root)
+    normroot = os.path.normpath(root)
     if not os.path.isabs(path):
-        path = os.path.join(root, path)
-    path = os.path.normpath(path)
+        path = os.path.join(normroot, path)
+    normpath = os.path.normpath(path)
     if realpath:
-        root = _realpath(root)
-        path = _realpath(path)
+        normroot = _realpath(normroot)
+        normpath = _realpath(normpath)
     if subdir:
-        if os.path.commonpath([path, root]) == root:
-            return path
+        if os.path.commonpath([normpath, normroot]) == normroot:
+            return normpath
     else:
-        if os.path.dirname(path) == root:
-            return path
+        if os.path.dirname(normpath) == normroot:
+            return normpath
     return ""
 
 
+def clean_join(root, *paths, subdir=False, realpath=True):
+    """
+    Performa a join and then check the result against the clean_path method. If
+    clean_path fails a SaltValidationError is raised.
+    """
+    path = os.path.join(root, *paths)
+    if not clean_path(root, path, subdir, realpath):
+        raise SaltValidationError(f"Invalid path: {path!r}")
+    return path
+
+
 def valid_id(opts, id_):
     """
     Returns if the passed id is valid

@@ -1,75 +0,0 @@
-"""
-Ensure salt.utils.clean_path works with symlinked directories and files
-"""
-
-import ctypes
-
-import pytest
-
-import salt.utils.verify
-
-
-class Symlink:
-    """
-    symlink(source, link_name) Creates a symbolic link pointing to source named
-    link_name
-    """
-
-    def __init__(self):
-        self._csl = None
-
-    def __call__(self, source, link_name):
-        if self._csl is None:
-            self._csl = ctypes.windll.kernel32.CreateSymbolicLinkW
-            self._csl.argtypes = (ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_uint32)
-            self._csl.restype = ctypes.c_ubyte
-        flags = 0
-        if source is not None and source.is_dir():
-            flags = 1
-
-        if self._csl(str(link_name), str(source), flags) == 0:
-            raise ctypes.WinError()
-
-
-@pytest.fixture(scope="module")
-def symlink():
-    return Symlink()
-
-
-@pytest.fixture
-def setup_links(tmp_path, symlink):
-    to_path = tmp_path / "linkto"
-    from_path = tmp_path / "linkfrom"
-    if salt.utils.platform.is_windows():
-        kwargs = {}
-    else:
-        kwargs = {"target_is_directory": True}
-    if salt.utils.platform.is_windows():
-        symlink(to_path, from_path, **kwargs)
-    else:
-        from_path.symlink_to(to_path, **kwargs)
-    return to_path, from_path
-
-
-def test_clean_path_symlinked_src(setup_links):
-    to_path, from_path = setup_links
-    test_path = from_path / "test"
-    expect_path = str(to_path / "test")
-    ret = salt.utils.verify.clean_path(str(from_path), str(test_path))
-    assert ret == expect_path, f"{ret} is not {expect_path}"
-
-
-def test_clean_path_symlinked_tgt(setup_links):
-    to_path, from_path = setup_links
-    test_path = to_path / "test"
-    expect_path = str(to_path / "test")
-    ret = salt.utils.verify.clean_path(str(from_path), str(test_path))
-    assert ret == expect_path, f"{ret} is not {expect_path}"
-
-
-def test_clean_path_symlinked_src_unresolved(setup_links):
-    to_path, from_path = setup_links
-    test_path = from_path / "test"
-    expect_path = str(from_path / "test")
-    ret = salt.utils.verify.clean_path(str(from_path), str(test_path), realpath=False)
-    assert ret == expect_path, f"{ret} is not {expect_path}"

@@ -2,10 +2,81 @@
 salt.utils.clean_path works as expected
 """
 
+import ctypes
+import os
+
+import pytest
+
 import salt.utils.verify
 from tests.support.mock import patch
 
 
+class Symlink:
+    """
+    symlink(source, link_name) Creates a symbolic link pointing to source named
+    link_name
+    """
+
+    def __init__(self):
+        self._csl = None
+
+    def __call__(self, source, link_name):
+        if self._csl is None:
+            self._csl = ctypes.windll.kernel32.CreateSymbolicLinkW
+            self._csl.argtypes = (ctypes.c_wchar_p, ctypes.c_wchar_p, ctypes.c_uint32)
+            self._csl.restype = ctypes.c_ubyte
+        flags = 0
+        if source is not None and source.is_dir():
+            flags = 1
+
+        if self._csl(str(link_name), str(source), flags) == 0:
+            raise ctypes.WinError()
+
+
+@pytest.fixture(scope="module")
+def symlink():
+    return Symlink()
+
+
+@pytest.fixture
+def setup_links(tmp_path, symlink):
+    to_path = tmp_path / "linkto"
+    from_path = tmp_path / "linkfrom"
+    if salt.utils.platform.is_windows():
+        kwargs = {}
+    else:
+        kwargs = {"target_is_directory": True}
+    if salt.utils.platform.is_windows():
+        symlink(to_path, from_path, **kwargs)
+    else:
+        from_path.symlink_to(to_path, **kwargs)
+    return to_path, from_path
+
+
+def test_clean_path_symlinked_src(setup_links):
+    to_path, from_path = setup_links
+    test_path = from_path / "test"
+    expect_path = str(to_path / "test")
+    ret = salt.utils.verify.clean_path(str(from_path), str(test_path))
+    assert ret == expect_path, f"{ret} is not {expect_path}"
+
+
+def test_clean_path_symlinked_tgt(setup_links):
+    to_path, from_path = setup_links
+    test_path = to_path / "test"
+    expect_path = str(to_path / "test")
+    ret = salt.utils.verify.clean_path(str(from_path), str(test_path))
+    assert ret == expect_path, f"{ret} is not {expect_path}"
+
+
+def test_clean_path_symlinked_src_unresolved(setup_links):
+    to_path, from_path = setup_links
+    test_path = from_path / "test"
+    expect_path = str(from_path / "test")
+    ret = salt.utils.verify.clean_path(str(from_path), str(test_path), realpath=False)
+    assert ret == expect_path, f"{ret} is not {expect_path}"
+
+
 def test_clean_path_valid(tmp_path):
     path_a = str(tmp_path / "foo")
     path_b = str(tmp_path / "foo" / "bar")
@@ -23,3 +94,24 @@ def test_clean_path_relative_root(tmp_path):
         path_a = "foo"
         path_b = str(tmp_path / "foo" / "bar")
         assert salt.utils.verify.clean_path(path_a, path_b) == path_b
+
+
+def test_clean_traverse_in_path_a(tmp_path):
+    path_a = str(tmp_path)
+    path_b = str(tmp_path / "foo" / ".." / "bar")
+    assert salt.utils.verify.clean_path(path_a, path_b) == os.path.normpath(path_b)
+
+
+def test_clean_traverse_in_path_b(tmp_path):
+    path_a = str(tmp_path)
+    path_b = str(tmp_path / "foo.foo/../bar")
+    assert salt.utils.verify.clean_path(path_a, path_b) == os.path.normpath(path_b)
+
+
+def test_clean_traverse_in_path_c(tmp_path):
+    path_a = str(tmp_path)
+    path_b = str(tmp_path / "foo/../bar/bang")
+    assert salt.utils.verify.clean_path(path_a, path_b) == ""
+    assert salt.utils.verify.clean_path(
+        path_a, path_b, subdir=True
+    ) == os.path.normpath(path_b)