Prevent cluster worker from overwriting protected master files - #37694

Description

MasterHandler.process_files_from_worker checked os.path.basename() on the raw worker-supplied file path for the client.keys and excluded_files guards, but wrote to a path resolved via safe_join()/os.path.normpath(), which strips trailing slashes. A key like "etc/ossec.conf/" produced an empty basename, bypassing both guards while still resolving to the real ossec.conf. Additionally, the function never checked whether a cluster item was allowed to flow from worker to master, so a worker could push any master-sourced file (agent.conf, rules, decoders, lists) with no bypass at all. The fix computes the basename from the already-normalized path and adds an explicit extra_valid check to reject any file whose cluster item is not marked as eligible for worker-to-master sync.

Proposed Changes

• framework/wazuh/core/cluster/master.py: in process_files_from_worker, compute client.keys/excluded_files basenames from the normalized full_path instead of the raw file_path; add a check that rejects any file whose cluster_items['files'][item_key]['extra_valid'] is not True.
• framework/wazuh/core/cluster/tests/test_master.py: added extra_valid: True to the test fixture's cluster_item_key/queue/testing/ items so existing tests keep exercising their intended code paths; updated basename call assertions to reflect the normalized-path argument; added two regression tests (test_master_handler_process_files_from_worker_rejects_non_extra_valid_item, test_master_handler_process_files_from_worker_normalizes_path_before_excluded_check).

Results and Evidence

• Confirmed both new tests fail against the pre-fix code and pass after the fix (verified via git stash on master.py only).
• pytest wazuh/core/cluster/tests/test_master.py: 54 passed.
• pytest wazuh/core/cluster/tests/: 450 passed (full cluster test suite, no regressions).

Artifacts Affected

• wazuh-clusterd (master-side cluster file sync).

Configuration Changes

None.

Documentation Updates

None.

Tests Introduced

• test_master_handler_process_files_from_worker_rejects_non_extra_valid_item (framework/wazuh/core/cluster/tests/test_master.py)
• test_master_handler_process_files_from_worker_normalizes_path_before_excluded_check (framework/wazuh/core/cluster/tests/test_master.py)

Credits

Thanks to @TarPeg007 for reporting this issue.

Review Checklist

• Code changes reviewed
• Relevant evidence provided
• Tests cover the new functionality
• Configuration changes documented
• Developer documentation reflects the changes
• Meets requirements and/or definition of done
• No unresolved dependencies with other issues
• PR is linked to the relevant issue(s)
• Correct labels applied (e.g., no-changelog)