fix(generate): First pass at fixing path traversal vuln #3195
Conversation
|
This is slightly overly conservative, technically speaking, in that it will prevent the creation of filenames like This still permits following symlinks in the out directory to arbitrary locations, if such symlinks exist. It looks like Go has a standard library routine for this in |
| return fmt.Errorf("invalid file output path: %s", filename) | ||
| } | ||
| // The output file must be contained inside the output directory | ||
| if !strings.HasPrefix(filename, absout) { |
There was a problem hiding this comment.
Has absout also been run through Clean? If so, there's a possibility that absout != filepath.Clean(absout) which would cause this to fail.
There was a problem hiding this comment.
It has, since the result of Join is cleaned.
…c-dev#3195) * fix(generate): First pass at fixing path traversal vuln * Add test
Verify that output file locations resolve to a path contained in the output directory.
Fixes #3194