Improvements to install/uninstall process #32
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| } | ||
|
|
||
| // Open the log file in append mode | ||
| file, err := os.OpenFile(logfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 4 months ago
To fix the problem, we need to validate the logfile parameter to ensure it does not contain any path traversal sequences or invalid characters. We can achieve this by checking that the resolved path is within a specific directory that is considered safe. This involves resolving the input with respect to that directory and then checking that the resulting path is still within it.
- Validate the
logfileparameter to ensure it does not contain any path traversal sequences or invalid characters. - Use
filepath.Absto get the absolute path and ensure it starts with the intended directory. - Update the
RunTerraformLogOutToFilefunction to include this validation.
| @@ -207,4 +207,11 @@ | ||
|
|
||
| // Validate logfile path | ||
| logDir := filepath.Join(appconf.Workdir, "install_logs") | ||
| absLogfile, err := filepath.Abs(logfile) | ||
| if err != nil || !strings.HasPrefix(absLogfile, logDir) { | ||
| return fmt.Errorf("invalid logfile path: %s", logfile) | ||
| } | ||
|
|
||
| // Open the log file in append mode | ||
| file, err := os.OpenFile(logfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) | ||
| file, err := os.OpenFile(absLogfile, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644) | ||
| if err != nil { |
| } | ||
|
|
||
| // Read the log file | ||
| content, err := os.ReadFile(logfile) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 4 months ago
To fix the problem, we need to ensure that the appName parameter does not contain any path traversal characters or sequences. This can be achieved by validating the appName parameter to ensure it does not contain any path separators ("/" or "\") or ".." sequences. If the validation fails, we should return an error response.
Steps to fix:
- Validate the
appNameparameter to ensure it does not contain any path separators or ".." sequences. - If the validation fails, return an HTTP error response.
- Proceed with the file path construction and file read operation only if the validation passes.
| @@ -122,2 +122,8 @@ | ||
|
|
||
| // Validate appName to prevent path traversal | ||
| if strings.Contains(appName, "/") || strings.Contains(appName, "\\") || strings.Contains(appName, "..") { | ||
| http.Error(c.Writer, "Invalid application name", http.StatusBadRequest) | ||
| return | ||
| } | ||
|
|
||
| // deploymentID, err := db.FetchDeploymentIDByApplicationName(deploymentName) |
No description provided.