Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ensure user input is sanitized #455

Open
UncleGedd opened this issue Feb 22, 2024 · 1 comment
Open

Ensure user input is sanitized #455

UncleGedd opened this issue Feb 22, 2024 · 1 comment

Comments

@UncleGedd
Copy link
Collaborator

Describe what should be investigated or refactored

The biggest issue is that the path key in a uds-bundle.yaml is not sanitized, which could potentially lead to path traversal vulnerabilities.

  • Go through the codebase and standardize filepath sanitization where necessary (look for user input)

Additional context

#453 (comment)

@naveensrinivasan
Copy link
Member

Google released a library for safe opening https://github.com/google/safeopen

https://bughunters.google.com/blog/4925068200771584/the-family-of-safe-golang-libraries-is-growing

cc @bburky

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants