Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use mholt/archives instead of mholt/archiver (#3128)

Browse Source 
* Use mholt/archives instead of mholt/archiver
* Fix validations
* Fix iszip function
* Fix directory
* Add better path sanitization
* ensure safe dir is passed
* Fix file permissions
* Fix config path
* Sanitize builder source path

---------

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
This commit is contained in:
Sanket Sudake
2025-01-08 11:00:54 +05:30
committed by GitHub
parent 54b67b5171
commit 4bce904c96
12 changed files with 721 additions and 155 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/builder/builder.go
+11 -7
View File
@@ -121,16 +121,20 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
}
logger.Info("builder received request", zap.Any("request", req))
if !utils.ValidateFilePathComponent(req.SrcPkgFilename) {
e := "invalid source package filename"
logger.Error(e, zap.String("filename", req.SrcPkgFilename))
builder.reply(r.Context(), w, "", e, http.StatusBadRequest)
logger.Debug("starting build")
srcPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename), builder.sharedVolumePath)
if err != nil {
logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
return
}
logger.Debug("starting build")
srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
deployPkgFilename := fmt.Sprintf("%s-%s", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))
deployPkgPath := filepath.Join(builder.sharedVolumePath, deployPkgFilename)
deployPkgPath, err := utils.SanitizeFilePath(filepath.Join(builder.sharedVolumePath, deployPkgFilename), builder.sharedVolumePath)
if err != nil {
logger.Error(err.Error(), zap.String("filename", req.SrcPkgFilename))
builder.reply(r.Context(), w, "", err.Error(), http.StatusBadRequest)
return
}
var buildArgs []string
buildCmd := req.BuildCommand