From d2d226e8f9499ac85b9297eb40216b9768f93081 Mon Sep 17 00:00:00 2001
From: Lifubang <lifubang@acmcoder.com>
Date: Fri, 31 Aug 2018 11:17:42 +0800
Subject: [PATCH] fix unexpected delete bug when container id is ..

Signed-off-by: Lifubang <lifubang@acmcoder.com>
---
 libcontainer/factory_linux.go | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/libcontainer/factory_linux.go b/libcontainer/factory_linux.go
index 4cbd70cd7..14e998b4f 100644
--- a/libcontainer/factory_linux.go
+++ b/libcontainer/factory_linux.go
@@ -229,6 +229,10 @@ func (l *LinuxFactory) Load(id string) (Container, error) {
 	if l.Root == "" {
 		return nil, newGenericError(fmt.Errorf("invalid root"), ConfigInvalid)
 	}
+	//when load, we need to check id is valid or not.
+	if err := l.validateID(id); err != nil {
+		return nil, err
+	}
 	containerRoot := filepath.Join(l.Root, id)
 	state, err := l.loadState(containerRoot, id)
 	if err != nil {
@@ -355,7 +359,23 @@ func (l *LinuxFactory) loadState(root, id string) (*State, error) {
 }
 
 func (l *LinuxFactory) validateID(id string) error {
-	if !idRegex.MatchString(id) {
+	if !idRegex.MatchString(id) || id == ".." || id == "." {
+		return newGenericError(fmt.Errorf("invalid id format: %v", id), InvalidIdFormat)
+	}
+
+	//For unforeseen invalid id situations, can checked by is SubDir?
+	rootPath, err := filepath.Abs(l.Root)
+	if err != nil {
+		return err
+	}
+
+	containerRoot := filepath.Join(l.Root, id)
+	rootCheckPath, err := filepath.Abs(filepath.Join(containerRoot, ".."))
+	if err != nil {
+		return err
+	}
+
+	if rootPath != rootCheckPath {
 		return newGenericError(fmt.Errorf("invalid id format: %v", id), InvalidIdFormat)
 	}