fix(security): driver uncontrolled data used in path expression injection

[odaysec]

OpenList/drivers/local/driver.go

Line 255 in 0c46199

err := os.MkdirAll(fullPath, os.FileMode(d.mkdirPerm))

Accessing files using paths constructed from user-controlled data can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files. paths that are naively constructed from data controlled by a user may be absolute paths, or may contain unexpected special characters such as "..". Such a path could point anywhere on the file system.

fix the issue, we need to validate the dirName parameter to ensure it does not contain any path traversal sequences (../, .., or path separators like / or \). Since dirName is expected to be a single directory name, we can enforce this by rejecting any input that contains these invalid characters.

• Adding a validation step for dirName before constructing the fullPath.
• Rejecting the input with an appropriate error if it contains invalid characters.

The changes will be made in the MakeDir function in drivers/local/driver.go.

[Copilot]

Pull Request Overview

This PR adds input validation for the dirName parameter in MakeDir to prevent path traversal vulnerabilities by rejecting names containing /, \, or ...

• Enforce validation on dirName before constructing the path.
• Return an error if dirName contains invalid traversal characters.
• Proceed to create the directory when validation passes.

Comments suppressed due to low confidence (1)

drivers/local/driver.go:255

• Add unit tests for MakeDir covering both valid names (e.g. alphanumeric only) and invalid cases (/, .., backslashes) to verify the new validation logic.

	if strings.Contains(dirName, "/") || strings.Contains(dirName, "\\") || strings.Contains(dirName, "..") {

[Copilot]

Avoid echoing raw user input in error messages to reduce risk of log injection; use %q to quote and escape the dirName value.

Suggested change

	return fmt.Errorf("invalid directory name: %s", dirName)
	return fmt.Errorf("invalid directory name: %q", dirName)

[Copilot]

[nitpick] Consider extracting the validation into a helper (e.g. isValidDirName) or consolidating the checks into a single regex or filepath.Base comparison for clearer intent and reuse.

Suggested change

	// Validate dirName to ensure it does not contain invalid characters
	if strings.Contains(dirName, "/") || strings.Contains(dirName, "\\") || strings.Contains(dirName, "..") {
	// Validate dirName using helper function
	if !isValidDirName(dirName) {

[hshpy]

OpenList/pkg/utils/path.go

Line 77 in e8d4539

func JoinBasePath(basePath, reqPath string) (string, error) {

OpenList/pkg/utils/path.go

Line 19 in e8d4539

func FixAndCleanPath(path string) string {

path有处理过

[j2rong4cn]

Thanks for pointing that out! The MakeDir function is not affected by this issue, but a similar risk does exist in the Rename function, which we're addressing in #744. Appreciate your thoughtful review!