Incus vulnerable to arbitrary file read and write through pongo templates

@@ -73,7 +73,6 @@ import (
 	"github.com/lxc/incus/v6/internal/server/state"
 	storagePools "github.com/lxc/incus/v6/internal/server/storage"
 	storageDrivers "github.com/lxc/incus/v6/internal/server/storage/drivers"
-	"github.com/lxc/incus/v6/internal/server/template"
 	localUtil "github.com/lxc/incus/v6/internal/server/util"
 	internalUtil "github.com/lxc/incus/v6/internal/util"
 	"github.com/lxc/incus/v6/internal/version"
@@ -7454,14 +7453,6 @@ func (d *lxc) templateApplyNow(trigger instance.TemplateTrigger) error {
 				return fmt.Errorf("Failed to read template file: %w", err)
 			}
 
-			// Restrict filesystem access to within the container's rootfs
-			tplSet := pongo2.NewSet(fmt.Sprintf("%s-%s", d.name, tpl.Template), template.ChrootLoader{Path: d.RootfsPath()})
-
-			tplRender, err := tplSet.FromString("{% autoescape off %}" + string(tplString) + "{% endautoescape %}")
-			if err != nil {
-				return fmt.Errorf("Failed to render template: %w", err)
-			}
-
 			configGet := func(confKey, confDefault *pongo2.Value) *pongo2.Value {
 				val, ok := d.expandedConfig[confKey.String()]
 				if !ok {
@@ -7471,8 +7462,7 @@ func (d *lxc) templateApplyNow(trigger instance.TemplateTrigger) error {
 				return pongo2.AsValue(strings.TrimRight(val, "\r\n"))
 			}
 
-			// Render the template
-			err = tplRender.ExecuteWriter(pongo2.Context{
+			err = internalUtil.RenderTemplateFile(w, string(tplString), pongo2.Context{
 				"trigger":    trigger,
 				"path":       tplPath,
 				"container":  containerMeta,
@@ -7481,9 +7471,9 @@ func (d *lxc) templateApplyNow(trigger instance.TemplateTrigger) error {
 				"devices":    d.expandedDevices,
 				"properties": tpl.Properties,
 				"config_get": configGet,
-			}, w)
+			})
 			if err != nil {
-				return err
+				return fmt.Errorf("Failed to render template: %w", err)
 			}
 
 			return w.Close()

@@ -75,7 +75,6 @@ import (
 	"github.com/lxc/incus/v6/internal/server/state"
 	storagePools "github.com/lxc/incus/v6/internal/server/storage"
 	storageDrivers "github.com/lxc/incus/v6/internal/server/storage/drivers"
-	pongoTemplate "github.com/lxc/incus/v6/internal/server/template"
 	localUtil "github.com/lxc/incus/v6/internal/server/util"
 	localvsock "github.com/lxc/incus/v6/internal/server/vsock"
 	internalUtil "github.com/lxc/incus/v6/internal/util"
@@ -3604,13 +3603,6 @@ func (d *qemu) templateApplyNow(trigger instance.TemplateTrigger, path string) e
 				return fmt.Errorf("Failed to read template file: %w", err)
 			}
 
-			// Restrict filesystem access to within the instance's rootfs.
-			tplSet := pongo2.NewSet(fmt.Sprintf("%s-%s", d.name, tpl.Template), pongoTemplate.ChrootLoader{Path: d.TemplatesPath()})
-			tplRender, err := tplSet.FromString("{% autoescape off %}" + string(tplString) + "{% endautoescape %}")
-			if err != nil {
-				return fmt.Errorf("Failed to render template: %w", err)
-			}
-
 			configGet := func(confKey, confDefault *pongo2.Value) *pongo2.Value {
 				val, ok := d.expandedConfig[confKey.String()]
 				if !ok {
@@ -3621,18 +3613,18 @@ func (d *qemu) templateApplyNow(trigger instance.TemplateTrigger, path string) e
 			}
 
 			// Render the template.
-			err = tplRender.ExecuteWriter(pongo2.Context{
+			err = internalUtil.RenderTemplateFile(w, string(tplString), pongo2.Context{
 				"trigger":    trigger,
 				"path":       tplPath,
-				"instance":   instanceMeta,
 				"container":  instanceMeta, // FIXME: remove once most images have moved away.
+				"instance":   instanceMeta,
 				"config":     d.expandedConfig,
 				"devices":    d.expandedDevices,
 				"properties": tpl.Properties,
 				"config_get": configGet,
-			}, w)
+			})
 			if err != nil {
-				return err
+				return fmt.Errorf("Failed to render template: %w", err)
 			}
 
 			return w.Close()

@@ -1,52 +0,0 @@
-package template
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"io"
-	"os"
-	"path/filepath"
-	"strings"
-)
-
-// ChrootLoader is a pong2 compatible file loader which restricts all accesses to a directory.
-type ChrootLoader struct {
-	Path string
-}
-
-// Abs resolves a filename relative to the base directory. Absolute paths are allowed.
-// When there's no base dir set, the absolute path to the filename
-// will be calculated based on either the provided base directory (which
-// might be a path of a template which includes another template) or
-// the current working directory.
-func (l ChrootLoader) Abs(base string, name string) string {
-	return filepath.Clean(fmt.Sprintf("%s/%s", l.Path, name))
-}
-
-// Get reads the path's content from your local filesystem.
-func (l ChrootLoader) Get(path string) (io.Reader, error) {
-	// Get the full path
-	path, err := filepath.EvalSymlinks(path)
-	if err != nil {
-		return nil, err
-	}
-
-	basePath, err := filepath.EvalSymlinks(l.Path)
-	if err != nil {
-		return nil, err
-	}
-
-	// Validate that we're under the expected prefix
-	if !strings.HasPrefix(path, basePath) {
-		return nil, errors.New("Attempting to access a file outside the instance")
-	}
-
-	// Open and read the file
-	buf, err := os.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-
-	return bytes.NewReader(buf), nil
-}

@@ -3,19 +3,22 @@ package util
 import (
 	"errors"
 	"fmt"
+	"io"
 	"strings"
 
 	"github.com/flosch/pongo2/v6"
 )
 
+var bannedTemplateTags = []string{"extends", "import", "include", "ssi"}
+
 // RenderTemplate renders a pongo2 template with nesting support.
 // This supports up to 3 levels of nesting (to avoid loops).
 func RenderTemplate(template string, ctx pongo2.Context) (string, error) {
 	// Prepare a custom set.
 	custom := pongo2.NewSet("render-template", pongo2.DefaultLoader)
 
 	// Block the use of some tags.
-	for _, tag := range []string{"extends", "import", "include", "ssi"} {
+	for _, tag := range bannedTemplateTags {
 		err := custom.BanTag(tag)
 		if err != nil {
 			return "", fmt.Errorf("Failed to configure custom pongo2 parser: Failed to block tag tag %q: %w", tag, err)
@@ -47,3 +50,32 @@ func RenderTemplate(template string, ctx pongo2.Context) (string, error) {
 
 	return "", errors.New("Maximum template recursion limit reached")
 }
+
+// RenderTemplateFile renders a pongo2 template to a file.
+// No nesting is supported in this scenario.
+func RenderTemplateFile(w io.Writer, template string, ctx pongo2.Context) error {
+	// Prepare a custom set.
+	custom := pongo2.NewSet("render-template", pongo2.DefaultLoader)
+
+	// Block the use of some tags.
+	for _, tag := range bannedTemplateTags {
+		err := custom.BanTag(tag)
+		if err != nil {
+			return fmt.Errorf("Failed to configure custom pongo2 parser: Failed to block tag tag %q: %w", tag, err)
+		}
+	}
+
+	// Load template from string
+	tpl, err := custom.FromString("{% autoescape off %}" + template + "{% endautoescape %}")
+	if err != nil {
+		return err
+	}
+
+	// Get rendered template
+	err = tpl.ExecuteWriter(ctx, w)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}