-
Notifications
You must be signed in to change notification settings - Fork 74
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixes #24011: Archiving allows to read inconsistent active technique category ids #5314
Conversation
} | ||
val target = recNewCategoryDirectory(catId, parents) | ||
|
||
if (target.getCanonicalPath().startsWith(getItemDirectory.getCanonicalPath())) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
👍
PR updated with a new commit |
uptcFile <- newActiveTechniquecFile(uptcId, getParents) | ||
gitPath = toGitPath(uptcFile) | ||
// don't forget to delete the category *directory* | ||
_ <- ZIO.whenZIO(IOResult.attempt(uptcFile.exists)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sometimes I added this IOResult.attempt
wrapper check over file.exists
I/O calls...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, but could you add an unit test demonstrating the new behavior?
PR updated with a new commit |
1 similar comment
PR updated with a new commit |
Added the unit test here, indeed the behavior is changed to raising the error in the |
This PR is not mergeable to upper versions. |
PR rebased |
d90d288
to
574a23d
Compare
OK, merging this PR |
https://issues.rudder.io/issues/24011
A lot of changes but the main one is throwing an error when accessing files outside the root configuration directory in with git (
/var/rudder/configuration-repository
) : https://github.com/Normation/rudder/pull/5314/files#diff-bb5734a3493073add0df1291f147ac6cd515b8a211f543610446796ed2374441R169-R187...This should avoid this method to be identified as vulnerable by any smart vulnerability scanners that could also detect the initial vulnerability...