Fix - faro/receiver - uncontrolled data used in path expression #3056
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return os.Stat(securedPath) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 10 days ago
To fix the problem, we need to enhance the validation logic in the securePath function to ensure that the constructed path does not contain any path traversal sequences and is within the intended directory. Specifically, we should:
- Ensure that the
nameparameter does not contain any path separators or parent directory references. - Validate that the final resolved path is within the
basePathdirectory.
| @@ -81,2 +81,8 @@ | ||
| } | ||
|
|
||
| // Ensure the name does not contain any path separators or parent directory references | ||
| if strings.Contains(name, "/") || strings.Contains(name, "\\") || strings.Contains(name, "..") { | ||
| return "", fmt.Errorf("invalid file name: %s", name) | ||
| } | ||
|
|
||
| cleanedPath := filepath.Clean(name) |
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return os.ReadFile(securedPath) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 10 days ago
To fix the problem, we need to ensure that the paths derived from user input are properly sanitized and validated. Specifically, we should:
- Ensure that the
securePathmethod always checks that the resolved path is within thebasePath, even if thebasePathis empty. - Improve the
cleanFilePathPartfunction to remove any remaining potentially dangerous characters. - Add additional validation to ensure that the
releasestring does not contain any path traversal sequences.
| @@ -84,3 +84,3 @@ | ||
| if fs.basePath == "" { | ||
| return cleanedPath, nil | ||
| fs.basePath = "." | ||
| } | ||
| @@ -385,3 +385,7 @@ | ||
| func cleanFilePathPart(x string) string { | ||
| return strings.TrimLeft(strings.ReplaceAll(strings.ReplaceAll(x, "\\", ""), "/", ""), ".") | ||
| cleaned := strings.ReplaceAll(strings.ReplaceAll(x, "\\", ""), "/", "") | ||
| if strings.Contains(cleaned, "..") { | ||
| return "" | ||
| } | ||
| return strings.TrimLeft(cleaned, ".") | ||
| } |
PR Description
Which issue(s) this PR fixes
Notes to the Reviewer
PR Checklist