Fix vulnerability in authenticated secrets API

[alexellis]

This patch fixes a vulnerability in the secrets API, however
it is important to stress that the user must be authenticated
as the admin user on the REST API before they can attempt this.

Reported by Appsecco via email. @LucasRoesler, Appsecco and
myself believe this to be of low severity.

The fix prevents directory traversal characters from being
used in secret names. If a secret name such as:
../../root/.ssh/authorized_keys were to be used, an attacker
could remove the value and write their own.

Signed-off-by: Alex Ellis (OpenFaaS Ltd) alexellis2@gmail.com

[alexellis]

@LucasRoesler please could you look at this broken test? It's currently breaking the CI, unfortunately this error wasn't detected previously because CI wasn't running "go test ./...".

Thanks

[abhisek]

Path traversal fix looks good.

But I think the utility function which is checking an input string for path traversal characters may be required in other places in code as well, either now or in future. It might make sense to keep it in its own namespace.

[alexellis]

Thanks for the suggestion. The way I see it is that when we have a need for other code to use the check, it can be exported or moved to another package.

@LucasRoesler has a test that needs patching for the build to pass, I'm going to merge this so that he can go ahead and send a PR for the log format.

The release will follow that PR.