From 3e57a280fe06f14b7f71b727d220f44c703976f4 Mon Sep 17 00:00:00 2001
From: Nathan Voxland <nathan@metabase.com>
Date: Tue, 6 Oct 2026 11:06:09 -0500
Subject: [PATCH] Apply the configured path settings to the Snowflake OIDC
 token file (#83496)

---
 .../snowflake/src/metabase/driver/snowflake.clj    |  3 ++-
 .../test/metabase/driver/snowflake_test.clj        | 14 ++++++++++++++
 src/metabase/driver_api/core.clj                   |  2 ++
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/modules/drivers/snowflake/src/metabase/driver/snowflake.clj b/modules/drivers/snowflake/src/metabase/driver/snowflake.clj
index ee42d1bd5e3..2163200956d 100644
--- a/modules/drivers/snowflake/src/metabase/driver/snowflake.clj
+++ b/modules/drivers/snowflake/src/metabase/driver/snowflake.clj
@@ -230,7 +230,8 @@
         token     (when (= "OIDC" provider)
                     (cond
                       (not (str/blank? wif-token-file-path))
-                      (str/trim (slurp wif-token-file-path))
+                      ;; an admin-supplied path the Metabase server reads, so it must be one `readable-paths` allows
+                      (str/trim (slurp (driver-api/ensure-readable-path! wif-token-file-path)))
 
                       (not (str/blank? wif-token))
                       wif-token))
diff --git a/modules/drivers/snowflake/test/metabase/driver/snowflake_test.clj b/modules/drivers/snowflake/test/metabase/driver/snowflake_test.clj
index 23edcb014b7..728b9f5591e 100644
--- a/modules/drivers/snowflake/test/metabase/driver/snowflake_test.clj
+++ b/modules/drivers/snowflake/test/metabase/driver/snowflake_test.clj
@@ -268,6 +268,20 @@
                          :wif-token-file-path tok-path))]
         (is (= "from-file" (:token spec)))))))
 
+(deftest ^:synchronized connection-details->spec-wif-oidc-file-path-readable-paths-test
+  (testing "the token file is read only from a directory `readable-paths` allows"
+    (mt/with-temp-file [tok-path "wif-token"]
+      (spit tok-path "from-file")
+      (let [spec (fn [] (sql-jdbc.conn/connection-details->spec
+                         :snowflake
+                         (assoc wif-base-details
+                                :wif-provider        "OIDC"
+                                :wif-token-file-path tok-path)))]
+        (mt/with-temp-env-var-value! [mb-readable-paths "NONE"]
+          (is (thrown-with-msg? clojure.lang.ExceptionInfo #"Reading from path is disallowed" (spec))))
+        (mt/with-temp-env-var-value! [mb-readable-paths (.getParent (java.io.File. ^String tok-path))]
+          (is (= "from-file" (:token (spec)))))))))
+
 (defn- fake-jwt
   "Build a JWT-shaped string with `claims` as the payload. Header and signature are placeholders —
   the token is only parseable, not verifiable."
diff --git a/src/metabase/driver_api/core.clj b/src/metabase/driver_api/core.clj
index 0c459f72825..551f0644f0e 100644
--- a/src/metabase/driver_api/core.clj
+++ b/src/metabase/driver_api/core.clj
@@ -176,6 +176,8 @@
  setting/defsetting
  sync-util/name-for-logging
  sync-util/reducible-sync-tables
+ system/ensure-readable-path!
+ system/ensure-writable-path!
  system/site-uuid
  upload.db/current-database)