Restrict use of subfolder in configfiles path

GET function on the config files path now lists all the contents
including sub directories. Creation of subdirectories under config files
is not allowed from the UI, however its possible to create manually.

If we try to access a subfolder with GET command, bmcweb handle the
folder name as file name and crashes trying to open.
Hence we limit the use of subfolder under config files by not listing
them in the response of the GET command. And returning an error if the
user is trying to run a GET on subfolder created manually.

Tested:
Create subfolder under configfiles path

curl -k -H "X-Auth-Token: $bmc_token" -X GET -D patch1.txt
https://${bmc}/ibm/v1/Host/ConfigFiles

Without fix:
Lists all contents of the ConfigFiles folder

With Fix:
lists only the regular files

Run the command with subfolder
curl -k -H "X-Auth-Token: $bmc_token" -X GET -D patch1.txt
https://${bmc}/ibm/v1/Host/ConfigFiles/testfolder

Without fix:
bmcweb crashes

With the fix:
“Description”: “Resource Not Found”

Change-Id: I71ef5523c6bc425e880a28a6e1175c677ef0a102
Signed-off-by: Jishnu C M <jishnunambiarcm@duck.com>

1 files changed, 6 insertions, 3 deletions

diff --git a/include/ibm/management_console_rest.hpp b/include/ibm/management_console_rest.hpp
index 97ac497aec..34befd7fb1 100644
--- a/include/ibm/management_console_rest.hpp
+++ b/include/ibm/management_console_rest.hpp
@@ -243,8 +243,11 @@ inline void
         for (const auto& file : std::filesystem::directory_iterator(loc))
         {
             const std::filesystem::path& pathObj = file.path();
-            pathObjList.push_back("/ibm/v1/Host/ConfigFiles/" +
-                                  pathObj.filename().string());
+            if (std::filesystem::is_regular_file(pathObj))
+            {
+                pathObjList.push_back("/ibm/v1/Host/ConfigFiles/" +
+                                      pathObj.filename().string());
+            }
         }
     }
     asyncResp->res.jsonValue["@odata.type"] =
@@ -302,7 +305,7 @@ inline void handleFileGet(const std::shared_ptr<bmcweb::AsyncResp>& asyncResp,
     BMCWEB_LOG_DEBUG << "HandleGet on SaveArea files on path: " << fileID;
     std::filesystem::path loc(
         "/var/lib/bmcweb/ibm-management-console/configfiles/" + fileID);
-    if (!std::filesystem::exists(loc))
+    if (!std::filesystem::exists(loc) || !std::filesystem::is_regular_file(loc))
     {
         BMCWEB_LOG_ERROR << loc.string() << " Not found";
         asyncResp->res.result(boost::beast::http::status::not_found);