Skip to content

BUG: Path traversal in folder cache sanitization #802

@andrinoff

Description

@andrinoff

Describe the bug
Folder name sanitization at config/folder_cache.go:67 doesn't prevent ../ sequences. Folder named containing ../ could escape cache directory.

To reproduce

  1. Create folder with name like "a/../sensitive"
  2. sanitizeFolderName() only replaces / but not ..
  3. Cache files written outside intended directory

Expected behavior
Use filepath.Clean() or reject names with ..

Matcha version
master

OS
All

Additional context
File: config/folder_cache.go line 67
Security: path traversal vulnerability

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinggood first issueGood for newcomers

    Type

    No type

    Projects

    Status

    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions