Apply the configured path settings to the Snowflake OIDC token file (#83496)

modules/drivers/snowflake/src/metabase/driver/snowflake.clj

@@ -230,7 +230,8 @@
         token     (when (= "OIDC" provider)
                     (cond
                       (not (str/blank? wif-token-file-path))
-                      (str/trim (slurp wif-token-file-path))
+                      ;; an admin-supplied path the Metabase server reads, so it must be one `readable-paths` allows
+                      (str/trim (slurp (driver-api/ensure-readable-path! wif-token-file-path)))
 
                       (not (str/blank? wif-token))
                       wif-token))

modules/drivers/snowflake/test/metabase/driver/snowflake_test.clj

@@ -268,6 +268,20 @@
                          :wif-token-file-path tok-path))]
         (is (= "from-file" (:token spec)))))))
 
+(deftest ^:synchronized connection-details->spec-wif-oidc-file-path-readable-paths-test
+  (testing "the token file is read only from a directory `readable-paths` allows"
+    (mt/with-temp-file [tok-path "wif-token"]
+      (spit tok-path "from-file")
+      (let [spec (fn [] (sql-jdbc.conn/connection-details->spec
+                         :snowflake
+                         (assoc wif-base-details
+                                :wif-provider        "OIDC"
+                                :wif-token-file-path tok-path)))]
+        (mt/with-temp-env-var-value! [mb-readable-paths "NONE"]
+          (is (thrown-with-msg? clojure.lang.ExceptionInfo #"Reading from path is disallowed" (spec))))
+        (mt/with-temp-env-var-value! [mb-readable-paths (.getParent (java.io.File. ^String tok-path))]
+          (is (= "from-file" (:token (spec)))))))))
+
 (defn- fake-jwt
   "Build a JWT-shaped string with `claims` as the payload. Header and signature are placeholders —
   the token is only parseable, not verifiable."

src/metabase/driver_api/core.clj

@@ -176,6 +176,8 @@
  setting/defsetting
  sync-util/name-for-logging
  sync-util/reducible-sync-tables
+ system/ensure-readable-path!
+ system/ensure-writable-path!
  system/site-uuid
  upload.db/current-database)