Skip to content

fix(generate): First pass at fixing path traversal vuln #3195

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kyleconroy merged 2 commits into from
Feb 14, 2024
Merged

fix(generate): First pass at fixing path traversal vuln #3195

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
aa3235b
fix(generate): First pass at fixing path traversal vuln
kyleconroy Feb 12, 2024
fc0eb2a
Add test
kyleconroy Feb 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions internal/cmd/generate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"os"
"path/filepath"
"runtime/trace"
"strings"
"sync"

"google.golang.org/grpc"
Expand Down Expand Up @@ -208,8 +209,21 @@ func (g *generator) ProcessResult(ctx context.Context, combo config.CombinedSett
files[file.Name] = string(file.Contents)
}
g.m.Lock()

// out is specified by the user, not a plugin
absout := filepath.Join(g.dir, out)

for n, source := range files {
filename := filepath.Join(g.dir, out, n)
// filepath.Join calls filepath.Clean which should remove all "..", but
// double check to make sure
if strings.Contains(filename, "..") {
return fmt.Errorf("invalid file output path: %s", filename)
}
// The output file must be contained inside the output directory
if !strings.HasPrefix(filename, absout) {
Copy link

@cbiffle cbiffle Feb 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Has absout also been run through Clean? If so, there's a possibility that absout != filepath.Clean(absout) which would cause this to fail.

Copy link
Collaborator Author

@kyleconroy kyleconroy Feb 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It has, since the result of Join is cleaned.

Copy link

@cbiffle cbiffle Feb 13, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, so it has. Thanks!

return fmt.Errorf("invalid file output path: %s", filename)
}
g.output[filename] = source
}
g.m.Unlock()
Expand Down