Files
nomad/command
Michael Schurter 3968509886 artifact: fix numerous go-getter security issues
Fix numerous go-getter security issues:

- Add timeouts to http, git, and hg operations to prevent DoS
- Add size limit to http to prevent resource exhaustion
- Disable following symlinks in both artifacts and `job run`
- Stop performing initial HEAD request to avoid file corruption on
  retries and DoS opportunities.

**Approach**

Since Nomad has no ability to differentiate a DoS-via-large-artifact vs
a legitimate workload, all of the new limits are configurable at the
client agent level.

The max size of HTTP downloads is also exposed as a node attribute so
that if some workloads have large artifacts they can specify a high
limit in their jobspecs.

In the future all of this plumbing could be extended to enable/disable
specific getters or artifact downloading entirely on a per-node basis.
2022-05-24 16:29:39 -04:00
..
2020-12-09 11:05:18 -08:00
2020-12-09 11:05:18 -08:00
2020-12-09 11:05:18 -08:00
2021-10-01 10:14:28 -04:00
2021-10-01 10:14:28 -04:00
2020-12-09 11:05:18 -08:00
2021-05-07 13:58:40 -04:00
2020-11-30 11:12:06 -05:00
2020-12-09 11:05:18 -08:00
2022-04-22 09:15:51 -05:00
2021-03-31 16:37:09 -04:00