SnmpKit.SafeFile (snmpkit v2.0.1)

Guarded file access for user-supplied inputs: walk files, JSON/YAML profiles, MIB sources and compiled MIBs, whether they reach the simulator, the MIB compiler, the linter or the manager's MIB registry.

Two limits apply to every read:

  • Size - files larger than :snmpkit, :max_input_file_bytes (default 64 MiB) are refused before they are read into memory.

  • Location - when :snmpkit, :input_roots is set to a list of directories, the expanded path (symlinks resolved) must live under one of them; anything else is refused with {:error, :outside_allowed_roots}. The default is nil, i.e. no confinement, which keeps existing deployments that load profiles from arbitrary paths working.

    config :snmpkit,

    max_input_file_bytes: 16 * 1024 * 1024,
input_roots: ["/srv/snmp/profiles", "priv/walks"]

Summary

Types

reason()

Functions

check(path, opts \\ [])

Validates a path against the configured roots and size limit and returns the resolved path to use.

configured_max_bytes()

The configured size limit in bytes.

configured_roots()

The configured allowed roots, or nil when unconfined.

read(path, opts \\ [])

Reads a whole file after checking its location and size.

stream(path, opts \\ [])

Opens a line stream over a file after checking its location and size.

Types

reason()

@type reason() :: :file_too_large | :outside_allowed_roots | File.posix()

Functions

check(path, opts \\ [])

@spec check(
  Path.t(),
  keyword()
) :: {:ok, Path.t()} | {:error, reason()}

Validates a path against the configured roots and size limit and returns the resolved path to use.

configured_max_bytes()

@spec configured_max_bytes() :: pos_integer()

The configured size limit in bytes.

configured_roots()

@spec configured_roots() :: [Path.t()] | nil

The configured allowed roots, or nil when unconfined.

read(path, opts \\ [])

@spec read(
  Path.t(),
  keyword()
) :: {:ok, binary()} | {:error, reason()}

Reads a whole file after checking its location and size.

stream(path, opts \\ [])

@spec stream(
  Path.t(),
  keyword()
) :: {:ok, Enumerable.t()} | {:error, reason()}

Opens a line stream over a file after checking its location and size.