Skip to content

.gitleaksignore should be treated as untrusted input #1572

@joerg1985

Description

@joerg1985

Describe the bug
The .gitleaksignore is usually part of the folder to scan, so this is part of external input to the tool.
It is possible to put a symlink to /dev/random into git, this will make the scanner run OOM.

To Reproduce
Steps to reproduce the behavior:
ln -s /dev/random .gitleaksignore

Expected behavior
Either don't follow symlinks or check the input is not malformed.

Basic Info (please complete the following information):

  • OS: Linux
  • Gitleaks Version: 8.18.2

cc @zricethezav

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions