Add path safety fixes (#3061)

* Add path safety fixes

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* minor changes

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

* revert test_huge_response test

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

---------

Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>

pkg/utils/serviceaccount.go

@@ -96,7 +96,7 @@ func CreateMissingPermissionForSA(ctx context.Context, kubernetesClient kubernet
 	if enableSA {
 		interval := getSAInterval()
 		logger.Debug("interval value", zap.Any("interval", interval))
-		sa := getSAObj(ctx, kubernetesClient, logger)
+		sa := getSAObj(kubernetesClient, logger)
 		logger.Info("Starting service account check", zap.Any("interval", interval))
 		if interval > 0 {
 			go wait.UntilWithContext(ctx, sa.runSACheck, interval)
@@ -106,7 +106,7 @@ func CreateMissingPermissionForSA(ctx context.Context, kubernetesClient kubernet
 	}
 }
 
-func getSAObj(ctx context.Context, kubernetesClient kubernetes.Interface, logger *zap.Logger) *ServiceAccount {
+func getSAObj(kubernetesClient kubernetes.Interface, logger *zap.Logger) *ServiceAccount {
 	saObj := &ServiceAccount{
 		kubernetesClient: kubernetesClient,
 		logger:           logger,

pkg/utils/utils.go

@@ -180,6 +180,10 @@ func isHttp2xxSuccessful(status int) bool {
 }
 
 func DownloadUrl(ctx context.Context, httpClient *http.Client, url string, localPath string) error {
+	// validate local path for directory traversal attacks
+	if filepath.Clean(localPath) != localPath {
+		return errors.Errorf("invalid local path: %s", localPath)
+	}
 	resp, err := ctxhttp.Get(ctx, httpClient, url)
 	if err != nil {
 		return err
@@ -305,3 +309,18 @@ func IsOwnerReferencesEnabled() bool {
 	disableOwnerReference, _ := strconv.ParseBool(os.Getenv(ENV_DISABLE_OWNER_REFERENCES))
 	return !disableOwnerReference
 }
+
+// ValidateFilePathComponent checks if the filename is valid to prevent directory traversal attacks.
+func ValidateFilePathComponent(filename string) bool {
+	return len(filename) > 0 && !containsInvalidChars(filename)
+}
+
+func containsInvalidChars(filename string) bool {
+	invalidChars := []string{"/", "\\", ".."}
+	for _, char := range invalidChars {
+		if strings.Contains(filename, char) {
+			return true
+		}
+	}
+	return false
+}