Skip to content

Security fixes #506

@general-kroll-4-life

Description

@general-kroll-4-life

Background

Bucket for some known security issues.

Acceptance criteria

  • All issues in Details section fixed.

Details

From PR on 2025-01-18



Uncontrolled data used in path expression
Step 1 selection of URL
Source
anysdk/mock_http.go:29
}

func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
	if err != nil {
		return nil, err
	}
Step 2 selection of Path
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}

func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
	if err != nil {
		return nil, err
	}
Step 3 call to TrimPrefix
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}

func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
	if err != nil {
		return nil, err
	}
Step 4 call to Join
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}

func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
	if err != nil {
		return nil, err
	}
Step 5 definition of relativePath
pkg/fileutil/util.go:25
	return filepath.Abs(filepath.Join(curDir, "../..", relativePath))
}

func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
Step 6 relativePath
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
	return filepath.ToSlash(rv), err
}

Step 7 call to Join
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
	return filepath.ToSlash(rv), err
}

Step 8 ... := ...[0]
pkg/fileutil/util.go:28
func GetForwardSlashFilePathFromRepositoryRoot(relativePath string) (string, error) {
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
	return filepath.ToSlash(rv), err
}

Step 9 rv
pkg/fileutil/util.go:29
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
	return filepath.ToSlash(rv), err
}

// func FilePathJoin(paths ...string) string {
Step 10 call to ToSlash
pkg/fileutil/util.go:29
	_, filename, _, _ := runtime.Caller(0)
	curDir := path.Dir(filename)
	rv, err := filepath.Abs(path.Join(curDir, "../..", relativePath))
	return filepath.ToSlash(rv), err
}

// func FilePathJoin(paths ...string) string {
Step 11 ... := ...[0]
[anysdk/mock_http.go:29](https://github.com/stackql/any-sdk/blob/58ff3b58c85392a4032573d4ce88d6425cc42e22/anysdk/mock_http.go#L29-L29)
}

func (rt *SimpleMockRegistryRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
	fp, err := fileutil.GetForwardSlashFilePathFromRepositoryRoot(path.Join(rt.fileRoot, strings.TrimPrefix(req.URL.Path, rt.registryRoot.Path)))
	if err != nil {
		return nil, err
	}
Step 12 fp
Sink
anysdk/mock_http.go:33
	if err != nil {
		return nil, err
	}
	f, err := os.Open(fp)
This path depends on a .
	if err != nil {
		return nil, err
	}

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions