From 7d11fa234693dcb50f4adb72a4c0e0111876d28c Mon Sep 17 00:00:00 2001
From: Junjie Gao <junjiegao@microsoft.com>
Date: Wed, 23 Oct 2024 02:59:09 +0000
Subject: [PATCH] fix: OS error when setting CRL cache leads to denial of
 signature verification

Signed-off-by: Junjie Gao <junjiegao@microsoft.com>
---
 internal/file/file.go      | 11 +++++++++--
 internal/file/file_test.go | 14 +++++++-------
 verifier/crl/crl.go        |  2 +-
 3 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/internal/file/file.go b/internal/file/file.go
index c6e95849..464db1cc 100644
--- a/internal/file/file.go
+++ b/internal/file/file.go
@@ -119,8 +119,15 @@ func TrimFileExtension(fileName string) string {
 
 // WriteFile writes content to a temporary file and moves it to path.
 // If path already exists and is a file, WriteFile overwrites it.
-func WriteFile(path string, content []byte) (writeErr error) {
-	tempFile, err := os.CreateTemp("", tempFileNamePrefix)
+//
+// Parameters:
+//   - tempDir is the directory to create the temporary file. It should be
+//     in the same mount point as path. If tempDir is empty, the default
+//     directory for temporary files is used.
+//   - path is the destination file path.
+//   - content is the content to write.
+func WriteFile(tempDir, path string, content []byte) (writeErr error) {
+	tempFile, err := os.CreateTemp(tempDir, tempFileNamePrefix)
 	if err != nil {
 		return fmt.Errorf("failed to create temp file: %w", err)
 	}
diff --git a/internal/file/file_test.go b/internal/file/file_test.go
index 306a0a5b..aeeea399 100644
--- a/internal/file/file_test.go
+++ b/internal/file/file_test.go
@@ -30,7 +30,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 
@@ -52,7 +52,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 
@@ -87,7 +87,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 		// forbid reading
@@ -113,7 +113,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 		// forbid dest directory operation
@@ -139,7 +139,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 		// forbid writing to destTempDir
@@ -159,7 +159,7 @@ func TestCopyToDir(t *testing.T) {
 		if err := os.MkdirAll(filepath.Dir(filename), 0700); err != nil {
 			t.Fatal(err)
 		}
-		if err := WriteFile(filename, data); err != nil {
+		if err := WriteFile(tempDir, filename, data); err != nil {
 			t.Fatal(err)
 		}
 
@@ -192,7 +192,7 @@ func TestWriteFile(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		err = WriteFile(filepath.Join(tempDir, "testFile"), content)
+		err = WriteFile(tempDir, filepath.Join(tempDir, "testFile"), content)
 		if err == nil || !strings.Contains(err.Error(), "permission denied") {
 			t.Fatalf("expected permission denied error, but got %s", err)
 		}
diff --git a/verifier/crl/crl.go b/verifier/crl/crl.go
index 9ebd16db..170d80f3 100644
--- a/verifier/crl/crl.go
+++ b/verifier/crl/crl.go
@@ -144,7 +144,7 @@ func (c *FileCache) Set(ctx context.Context, url string, bundle *corecrl.Bundle)
 	if err != nil {
 		return fmt.Errorf("failed to store crl bundle in file cache: %w", err)
 	}
-	if err := file.WriteFile(filepath.Join(c.root, c.fileName(url)), contentBytes); err != nil {
+	if err := file.WriteFile(c.root, filepath.Join(c.root, c.fileName(url)), contentBytes); err != nil {
 		return fmt.Errorf("failed to store crl bundle in file cache: %w", err)
 	}
 	return nil