Add path safety fixes (#3061)

* Add path safety fixes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * minor changes Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> * revert test_huge_response test Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> --------- Signed-off-by: Sanket Sudake <sanketsudake@gmail.com>
2024-11-18 12:19:34 +05:30
parent 82c0fbaeda
commit 59267e3a6b
5 changed files with 57 additions and 12 deletions
@@ -180,6 +180,10 @@ func isHttp2xxSuccessful(status int) bool {
 }

 func DownloadUrl(ctx context.Context, httpClient *http.Client, url string, localPath string) error {
+	// validate local path for directory traversal attacks
+	if filepath.Clean(localPath) != localPath {
+		return errors.Errorf("invalid local path: %s", localPath)
+	}
 	resp, err := ctxhttp.Get(ctx, httpClient, url)
 	if err != nil {
 		return err
@@ -305,3 +309,18 @@ func IsOwnerReferencesEnabled() bool {
 	disableOwnerReference, _ := strconv.ParseBool(os.Getenv(ENV_DISABLE_OWNER_REFERENCES))
 	return !disableOwnerReference
 }
+
+// ValidateFilePathComponent checks if the filename is valid to prevent directory traversal attacks.
+func ValidateFilePathComponent(filename string) bool {
+	return len(filename) > 0 && !containsInvalidChars(filename)
+}
+
+func containsInvalidChars(filename string) bool {
+	invalidChars := []string{"/", "\\", ".."}
+	for _, char := range invalidChars {
+		if strings.Contains(filename, char) {
+			return true
+		}
+	}
+	return false
+}