Skip to content

Commit

Permalink
fix path traversal which flagged by snyk scan
Browse files Browse the repository at this point in the history
```
 ✗ [Low] Path Traversal
   ID: 28235865-e32e-466c-a079-e826f744c2a8
   Path: test/extended/util/prepare.go, line 100
   Info: Unsanitized input from file name flows into os.RemoveAll, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to delete arbitrary files.
```
  • Loading branch information
Alberto Fanjul authored and praveenkumar committed Sep 26, 2024
1 parent 9cfc806 commit 70949d5
Show file tree
Hide file tree
Showing 3 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion pkg/extract/extract.go
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ func unzip(archive, target string, fileFilter func(string) bool, showProgress bo
continue
}

if err := unzipFile(file, path, showProgress); err != nil {
if err := unzipFile(file, filepath.Clean(path), showProgress); err != nil {
return nil, err
}
extractedFiles = append(extractedFiles, path)
Expand Down
2 changes: 1 addition & 1 deletion test/extended/util/prepare.go
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ func CleanTestRunDir() error {
}

for _, file := range files {
err := os.RemoveAll(filepath.Join(TestRunDir, file.Name()))
err := os.RemoveAll(filepath.Clean(filepath.Join(TestRunDir, file.Name())))
if err != nil {
return err
}
Expand Down
2 changes: 1 addition & 1 deletion test/extended/util/util.go
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ func CopyResourcesFromPath(resourcesPath string) error {
sFileName := filepath.Join(resourcesPath, file.Name())
fmt.Printf("Copying %s to %s\n", sFileName, destLoc)

sFile, err := os.Open(sFileName)
sFile, err := os.Open(filepath.Clean(sFileName))
if err != nil {
fmt.Printf("Error occurred opening file: %s", err)
return err
Expand Down

0 comments on commit 70949d5

Please sign in to comment.