Add path safety fixes (#3061)

* Add path safety fixes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * minor changes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * revert test_huge_response test Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> --------- Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
2024-11-18 12:19:34 +05:30
parent 82c0fbaeda
commit 59267e3a6b
5 changed files with 57 additions and 12 deletions
@@ -121,6 +121,12 @@ func (builder *Builder) Handler(w http.ResponseWriter, r *http.Request) {
 	}
 	logger.Info("builder received request", zap.Any("request", req))

+	if !utils.ValidateFilePathComponent(req.SrcPkgFilename) {
+		e := "invalid source package filename"
+		logger.Error(e, zap.String("filename", req.SrcPkgFilename))
+		builder.reply(r.Context(), w, "", e, http.StatusBadRequest)
+		return
+	}
 	logger.Debug("starting build")
 	srcPkgPath := filepath.Join(builder.sharedVolumePath, req.SrcPkgFilename)
 	deployPkgFilename := fmt.Sprintf("%s-%s", req.SrcPkgFilename, strings.ToLower(uniuri.NewLen(6)))