Fix path traversal attack in -proto-out-dir (#573)

* Fix path traversal in `-proto-out-dir`

A malicious file descriptor name (e.g. from an untrusted protoset or
server reflection) could escape the output directory through ../
sequences, writing attacker-controlled content to arbitrary paths.

Confine all writes to an `os.Root` opened on the output directory.

* assert

* refactor

---------

Co-authored-by: Scott Blum <dragonsinth@gmail.com>

desc_source.go

@@ -309,24 +309,37 @@ func WriteProtoFiles(outProtoDirPath string, descSource DescriptorSource, symbol
 	for _, filename := range filenames {
 		allFileDescriptors = addFilesToFileDescriptorList(allFileDescriptors, expandedFiles, fds[filename])
 	}
+	return writeProtoFiles(outProtoDirPath, allFileDescriptors)
+}
+
+func writeProtoFiles(outProtoDirPath string, allFileDescriptors []*desc.FileDescriptor) error {
+	if err := os.MkdirAll(outProtoDirPath, 0755); err != nil {
+		return fmt.Errorf("failed to create output directory %q: %w", outProtoDirPath, err)
+	}
+	root, err := os.OpenRoot(outProtoDirPath)
+	if err != nil {
+		return fmt.Errorf("failed to open output directory %q: %w", outProtoDirPath, err)
+	}
+	defer root.Close()
 	pr := protoprint.Printer{}
 	// now we can serialize to files
 	for i := range allFileDescriptors {
-		if err := writeProtoFile(outProtoDirPath, allFileDescriptors[i], &pr); err != nil {
+		if err := writeProtoFile(root, allFileDescriptors[i], &pr); err != nil {
 			return err
 		}
 	}
 	return nil
 }
 
-func writeProtoFile(outProtoDirPath string, fd *desc.FileDescriptor, pr *protoprint.Printer) error {
-	outFile := filepath.Join(outProtoDirPath, fd.GetFullyQualifiedName())
-	outDir := filepath.Dir(outFile)
-	if err := os.MkdirAll(outDir, 0777); err != nil {
-		return fmt.Errorf("failed to create directory %q: %w", outDir, err)
+func writeProtoFile(root *os.Root, fd *desc.FileDescriptor, pr *protoprint.Printer) error {
+	// root confines all path operations to the output directory, so a
+	// malicious file name (e.g. "../escape.proto") cannot write outside it
+	outFile := fd.GetFullyQualifiedName()
+	if err := root.MkdirAll(filepath.Dir(outFile), 0755); err != nil {
+		return fmt.Errorf("failed to create directory for %q: %w", outFile, err)
 	}
 
-	f, err := os.Create(outFile)
+	f, err := root.Create(outFile)
 	if err != nil {
 		return fmt.Errorf("failed to create proto file %q: %w", outFile, err)
 	}