Fix path traversal vulnerabilities in update-readme tool #40
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: harche The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/hold until |
openshift-ci
bot
added
the
do-not-merge/hold
harche
force-pushed
the
fix-security-path-traversal
branch
from
5c01dfe to
7172f3e
Compare
harche
changed the title
openshift-ci
bot
added
the
do-not-merge/work-in-progress
Add input validation to prevent path traversal attacks in the update-readme internal tool: - Clean file path using filepath.Clean to remove path traversal sequences - Validate that only README.md files can be updated - Add argument count validation This fixes Snyk code scan findings: - MEDIUM severity path traversal in os.ReadFile (line 28) - MEDIUM severity path traversal in os.WriteFile (line 84) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
harche
force-pushed
the
fix-security-path-traversal
branch
from
7172f3e to
2516eac
Compare
|
/test fips-image-scan-openshift-mcp-server |
|
@harche: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
harche
changed the title
openshift-ci
bot
removed
the
do-not-merge/work-in-progress
|
/hold cancel lint job failures are fixed in #39 |
openshift-ci
bot
removed
the
do-not-merge/hold
|
/cc @manusa |
|
@ardaguclu: GitHub didn't allow me to request PR reviews from the following users: manusa. Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Hey @harche I think we fixed this on the upstream repo here: containers#345 and just need to backport that here (cc @ardaguclu @manusa) |
|
Great, thanks. /close |
|
IT's fixed, if snyk still complains we'll need to add the exception. |
|
@harche: Closed this PR. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Summary
Fix path traversal vulnerabilities detected by Snyk code scan in the
internal/tools/update-readmetool.🤖 Generated with Claude Code