Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix path traversal vulnerability detection on close #3172

Merged
merged 1 commit into from
May 19, 2023

Conversation

uurien
Copy link
Collaborator

@uurien uurien commented May 18, 2023

What does this PR do?

We have detected that an extra vulnerability was reported on dir.close function when the open was already vulnerable point. This PR prevents this double detection.

Plugin Checklist

  • Unit tests.

@github-actions
Copy link

github-actions bot commented May 18, 2023

Overall package size

Self size: 4.13 MB
Deduped: 58.26 MB
No deduping: 58.31 MB

Dependency sizes

name version self size total size
@datadog/pprof 2.2.1 14.24 MB 15.12 MB
@datadog/native-iast-taint-tracking 1.4.1 14.85 MB 14.86 MB
@datadog/native-appsec 3.1.0 13.31 MB 13.32 MB
protobufjs 7.1.2 2.76 MB 6.55 MB
@datadog/native-iast-rewriter 2.0.1 2.09 MB 2.1 MB
@datadog/native-metrics 2.0.0 898.77 kB 1.3 MB
opentracing 0.14.7 194.81 kB 194.81 kB
semver 7.3.8 88.2 kB 118.6 kB
@datadog/sketches-js 2.1.0 109.9 kB 109.9 kB
lodash.sortby 4.7.0 75.76 kB 75.76 kB
lru-cache 7.14.0 74.95 kB 74.95 kB
ipaddr.js 2.0.1 59.52 kB 59.52 kB
ignore 5.2.0 48.87 kB 48.87 kB
import-in-the-middle 1.3.5 34.34 kB 38.81 kB
istanbul-lib-coverage 3.2.0 29.34 kB 29.34 kB
retry 0.10.1 27.44 kB 27.44 kB
lodash.uniq 4.5.0 25.01 kB 25.01 kB
limiter 1.1.5 23.17 kB 23.17 kB
lodash.kebabcase 4.1.1 17.75 kB 17.75 kB
lodash.pick 4.4.0 16.33 kB 16.33 kB
node-abort-controller 3.0.1 14.33 kB 14.33 kB
crypto-randomuuid 1.0.0 11.18 kB 11.18 kB
diagnostics_channel 1.1.0 7.07 kB 7.07 kB
path-to-regexp 0.1.7 6.78 kB 6.78 kB
koalas 1.0.2 6.47 kB 6.47 kB
methods 1.1.2 5.29 kB 5.29 kB
module-details-from-path 1.0.3 4.47 kB 4.47 kB

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@uurien uurien force-pushed the ugaitz/improve-path-traversal-detection branch from 3154e12 to 266ed34 Compare May 18, 2023 15:22
@codecov
Copy link

codecov bot commented May 18, 2023

Codecov Report

Merging #3172 (8627c97) into master (3428a1f) will increase coverage by 0.02%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #3172      +/-   ##
==========================================
+ Coverage   86.95%   86.97%   +0.02%     
==========================================
  Files         322      322              
  Lines       11763    11765       +2     
  Branches       33       33              
==========================================
+ Hits        10228    10233       +5     
+ Misses       1535     1532       -3     
Impacted Files Coverage Δ
...c/appsec/iast/analyzers/path-traversal-analyzer.js 100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@uurien uurien marked this pull request as ready for review May 18, 2023 15:27
@uurien uurien requested a review from a team as a code owner May 18, 2023 15:27
@uurien uurien force-pushed the ugaitz/improve-path-traversal-detection branch from 266ed34 to 8627c97 Compare May 18, 2023 15:35
@uurien uurien changed the title Fix path traversal vulnerability on dir.close Fix path traversal vulnerability on close May 18, 2023
@pr-commenter
Copy link

pr-commenter bot commented May 18, 2023

Benchmarks

Comparing candidate commit 8627c97 in PR branch ugaitz/improve-path-traversal-detection with baseline commit 3428a1f in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 445 metrics, 27 unstable metrics.

@uurien uurien merged commit 7646468 into master May 19, 2023
104 checks passed
@uurien uurien changed the title Fix path traversal vulnerability on close Fix path traversal vulnerability detection on close May 19, 2023
This was referenced Jun 1, 2023
@tlhunter tlhunter deleted the ugaitz/improve-path-traversal-detection branch January 19, 2024 22:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

4 participants