Routing parity: TS path-wide exec deny; Go matchEndpoint accepts endpoint subpaths #49

Activity

1. abienkowski

   added

   Priority: P3Added to issues and PRs relating to a low severity bugs.Added to issues and PRs relating to a low severity bugs.

   Type: BugAdded to issues and PRs if they are addressing a bugAdded to issues and PRs if they are addressing a bug

   on Oct 2, 2026
2. abienkowski commented on Oct 7, 2026

   

   abienkowski

   on Oct 7, 2026

   CollaboratorAuthor

   More actions

   A third case in this family, confirmed during the #51 merge-gate review by running the Go router directly:

   • DELETE /containers/<name>/exec — Go's exec check (matchEndpoint(path, "containers", "exec")) matches exec only in the name position, so this path takes the lifecycle branch and is allowed and forwarded. Rust (path.contains("/exec") after the /containers/ prefix check) and TypeScript (path.includes("/exec")) both deny it.
   • Related: POST /containers/<name>/exec is denied in Go too, but by default-deny rather than the exec check — the three implementations agree on the status for that one, for different reasons.

   Observed outputs (Go router, built from main):

   DELETE /containers/mycontainer/exec -> Allow (forwarded)
   POST   /containers/mycontainer/exec -> Deny  "endpoint ... is not allowed"
   DELETE /containers/exec             -> Deny  "exec is not allowed"
   

   So when converging the exec rule, the decision isn't only about TS being too broad — Go is too narrow. spec/README.md's Modeling Notes (post-#51) document this divergence and point here. Note deploy/test.sh's POST /containers/*/exec -> 403 check passes for different reasons per language today.
3. abienkowski commented on Oct 8, 2026

   

   abienkowski

   on Oct 8, 2026

   CollaboratorAuthor

   More actions

   Decided design (2026-10-08). Probe of all three routers on main:

   Request	Go	Rust	TS
   DELETE /containers/mycontainer/exec	Allow	Deny	Deny
   POST /containers/exec-runner/start	Allow	Deny	Deny
   DELETE /containers/exec-runner	Allow	Deny	Deny
   GET /containers/exec-runner/json	Allow	Deny	Deny
   GET /images/exec	Allow	Allow	Deny
   GET /exec/abc/json	Allow	Allow	Deny
   POST /containers/create/extra	CreateContainer	Deny	Deny
   POST /images/create/extra	Allow	Deny	Deny

   New case: Rust (contains("/exec")) and TS (includes("/exec")) are substring checks. A container whose name starts with exec (exec-runner, executor) therefore cannot be started, removed or inspected through them, although the daemon allows such names.

   Rule, matching whole path segments (after the version strip):

   • Exec is denied when the segments are containers/<name>/exec, for any method, or when the first segment is exec, for every method including GET. Exec inspect leaks command lines: container inspect lists ExecIDs, and GET /exec/<id>/json then shows the full arguments, including inline secrets (verified live). /containers/exec stays a reserved name.
   • Exact endpoints: POST /containers/create and POST /images/create match only with exactly two segments. Anything longer falls to the default deny.
   • Spec rows first (spec/router.qnt), then a shared test table in all three languages plus integration checks.

   The per-socket exec feature is split out to #65.
4. abienkowski

   added 3 commits that reference this issue on Oct 8, 2026

   spec: clarify the #49 history note (#49)

   90da0b4

   refactor: parenthesise the Go exec check; exact README exec row (#49)

   cc9be76

   fix: match exec and create endpoints on whole path segments (#49) (#67)

   ...

   3a410f1
5. abienkowski

   closed this as completedin #67on Oct 9, 2026