security: protect multi-root virtual mounts

chfs-ng/internal/storage/multipath.go

@@ -109,24 +109,24 @@ func (m Multi) Create(p string) (*os.File, error) {
 }
 func (m Multi) Remove(p string) error {
 	r, rel, ok := m.find(p)
-	if !ok {
-		return os.ErrNotExist
+	if !ok || rel == "" {
+		return os.ErrInvalid
 	}
 	return r.Remove(rel)
 }
 
 func (m Multi) Trash(p string) error {
 	r, rel, ok := m.find(p)
-	if !ok {
-		return os.ErrNotExist
+	if !ok || rel == "" {
+		return os.ErrInvalid
 	}
 	return r.Trash(rel)
 }
 
 func (m Multi) MoveToTrash(p, trashRoot string) error {
 	r, rel, ok := m.find(p)
-	if !ok {
-		return os.ErrNotExist
+	if !ok || rel == "" {
+		return os.ErrInvalid
 	}
 	return r.MoveToTrash(rel, filepath.Join(trashRoot, m.RootName(r)))
 }
@@ -142,7 +142,7 @@ func (m Multi) RootName(r Local) string {
 func (m Multi) Rename(a, b string) error {
 	ra, aa, oka := m.find(a)
 	rb, bb, okb := m.find(b)
-	if !oka || !okb || ra.Root != rb.Root {
+	if !oka || !okb || aa == "" || bb == "" || ra.Root != rb.Root {
 		return os.ErrInvalid
 	}
 	return ra.Rename(aa, bb)

chfs-ng/internal/storage/multipath_test.go

@@ -24,3 +24,18 @@ func TestNewMultiKeepsDuplicateBasenames(t *testing.T) {
 		t.Fatalf("unexpected virtual names: %v", m.Names)
 	}
 }
+
+func TestMultiRejectsMutationOfVirtualRoot(t *testing.T) {
+	root1 := t.TempDir()
+	root2 := t.TempDir()
+	m := NewMulti([]string{root1, root2})
+	if err := m.Remove(m.Names[0]); err == nil {
+		t.Fatal("expected virtual root removal to be rejected")
+	}
+	if _, err := m.Create(m.Names[0]); err == nil {
+		t.Fatal("expected virtual root creation to be rejected")
+	}
+	if err := m.Rename(m.Names[0], m.Names[1]); err == nil {
+		t.Fatal("expected virtual root rename to be rejected")
+	}
+}