-
-
Notifications
You must be signed in to change notification settings - Fork 79
Open
Description
Background
Bucket for some known security issues.
Acceptance criteria
- All issues in
Detailssection fixed.
Details
From PR on 2025-01-18
Uncontrolled data used in path expression
Step 1 selection of URL
Source
anysdk/mock_http.go:29
}
func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
if err != nil {
return nil, err
}
Step 2 selection of Path
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}
func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
if err != nil {
return nil, err
}
Step 3 call to TrimPrefix
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}
func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
if err != nil {
return nil, err
}
Step 4 call to Join
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}
func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
if err != nil {
return nil, err
}
Step 5 definition of relativePath
pkg/fileutil/util.go:25
return filepath.Abs(filepath.Join(curDir, "../..", relativePath))
}
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
Step 6 relativePath
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
return filepath.ToSlash(rv), err
}
Step 7 call to Join
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
return filepath.ToSlash(rv), err
}
Step 8 ... := ...[0]
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
return filepath.ToSlash(rv), err
}
Step 9 rv
pkg/fileutil/util.go:29
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
return filepath.ToSlash(rv), err
}
// func FilePathJoin(paths ...string) string {
Step 10 call to ToSlash
pkg/fileutil/util.go:29
_, filename, _, _ := runtime.Caller(0)
curDir := path.Dir(filename)
rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
return filepath.ToSlash(rv), err
}
// func FilePathJoin(paths ...string) string {
Step 11 ... := ...[0]
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}
func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
if err != nil {
return nil, err
}
Step 12 fp
Sink
anysdk/mock_http.go:33
if err != nil {
return nil, err
}
f, err := os.Open(fp)
This path depends on a .
if err != nil {
return nil, err
}
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels
Type
Projects
Status
Done