Check file path prefixes #1844
Check file path prefixes #1844
Conversation
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @@ -393,7 +394,10 @@ | |||
|
|
|||
| def self.open_local_file(path, scope:) | |||
| full_path = "#{OPENC3_LOCAL_MODE_PATH}/#{scope}/targets_modified/#{path}" | |||
| return File.open(full_path, 'rb') | |||
| if File.expand_path(full_path).start_with?(OPENC3_LOCAL_MODE_PATH) | |||
| return File.open(full_path, 'rb') | |||
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 days ago
To fix the problem, we need to ensure that the full_path is properly sanitized and validated before being used in file operations. This can be achieved by implementing stricter validation rules and using a whitelist of allowed patterns for the scope and path parameters.
- Implement a method to validate the
scopeandpathparameters against a whitelist of allowed patterns. - Use this validation method in the
open_local_filemethod to ensure that thefull_pathis safe to use. - Update the
sanitize_paramsmethod to include additional validation rules if necessary.
| @@ -395,2 +395,3 @@ | ||
| def self.open_local_file(path, scope:) | ||
| return nil unless valid_scope?(scope) && valid_path?(path) | ||
| full_path = "#{OPENC3_LOCAL_MODE_PATH}/#{scope}/targets_modified/#{path}" | ||
| @@ -585,2 +586,15 @@ | ||
| end | ||
| private | ||
|
|
||
| def self.valid_scope?(scope) | ||
| # Add validation logic for scope | ||
| # Example: only allow alphanumeric characters and underscores | ||
| /^[a-zA-Z0-9_]+$/.match?(scope) | ||
| end | ||
|
|
||
| def self.valid_path?(path) | ||
| # Add validation logic for path | ||
| # Example: only allow alphanumeric characters, underscores, and forward slashes | ||
| /^[a-zA-Z0-9_\/]+$/.match?(path) && !path.include?('..') | ||
| end | ||
| end |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1844 +/- ##
==========================================
- Coverage 79.57% 79.55% -0.02%
==========================================
Files 519 519
Lines 40774 40787 +13
==========================================
+ Hits 32444 32447 +3
- Misses 8330 8340 +10
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
No description provided.