Skip to content

Commit 0984595

Browse files
author
Aleksandra Chyła
committed
Issue #4261 - Fix CWE-73: File Manipulation
Signed-off-by: Aleksandra Chyła <aleksandra.chyla@ibm.com>
1 parent be403c8 commit 0984595

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+451
-406
lines changed

‎agreementbot/api.go

+8-7
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,13 @@ package agreementbot
33
import (
44
"encoding/json"
55
"fmt"
6+
"io"
7+
"net/http"
8+
"regexp"
9+
"sort"
10+
"sync"
11+
"time"
12+
613
"github.com/golang/glog"
714
"github.com/gorilla/mux"
815
"github.com/open-horizon/anax/abstractprotocol"
@@ -14,12 +21,6 @@ import (
1421
"github.com/open-horizon/anax/exchange"
1522
"github.com/open-horizon/anax/policy"
1623
"github.com/open-horizon/anax/worker"
17-
"io/ioutil"
18-
"net/http"
19-
"regexp"
20-
"sort"
21-
"sync"
22-
"time"
2324
)
2425

2526
type API struct {
@@ -544,7 +545,7 @@ func (a *API) policy(w http.ResponseWriter, r *http.Request) {
544545

545546
// Demarshal the input body and verify it.
546547
var upgrade UpgradeDevice
547-
body, _ := ioutil.ReadAll(r.Body)
548+
body, _ := io.ReadAll(r.Body)
548549
if err := json.Unmarshal(body, &upgrade); err != nil {
549550
writeInputErr(w, http.StatusBadRequest, &APIUserInputError{Input: "body", Error: fmt.Sprintf("user submitted data couldn't be deserialized to struct: %v. Error: %v", string(body), err)})
550551
return

‎agreementbot/pattern_manager_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -8,11 +8,11 @@ import (
88
"errors"
99
"flag"
1010
"fmt"
11-
"github.com/open-horizon/anax/exchange"
12-
"io/ioutil"
1311
"os"
1412
"strings"
1513
"testing"
14+
15+
"github.com/open-horizon/anax/exchange"
1616
)
1717

1818
func init() {
@@ -781,7 +781,7 @@ func getPatternEntryFiles(files []string) error {
781781
func getPolicyFiles(homePath string) ([]os.FileInfo, error) {
782782
res := make([]os.FileInfo, 0, 10)
783783

784-
if files, err := ioutil.ReadDir(homePath); err != nil {
784+
if files, err := io.ReadDir(homePath); err != nil {
785785
return nil, err
786786
} else {
787787
for _, fileInfo := range files {

‎agreementbot/secrets/vault/http.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,16 @@ import (
77
"encoding/json"
88
"errors"
99
"fmt"
10-
"github.com/golang/glog"
11-
"github.com/open-horizon/anax/agreementbot/secrets"
12-
"github.com/open-horizon/anax/config"
1310
"io"
14-
"io/ioutil"
1511
"net"
1612
"net/http"
1713
"os"
1814
"strings"
1915
"time"
16+
17+
"github.com/golang/glog"
18+
"github.com/open-horizon/anax/agreementbot/secrets"
19+
"github.com/open-horizon/anax/config"
2020
)
2121

2222
// Retry intervals when connecting to the vault
@@ -96,7 +96,7 @@ func (vs *AgbotVaultSecrets) newHTTPClient(cfg *config.HorizonConfig) (*http.Cli
9696

9797
if _, err = os.Stat(cfg.GetVaultCertPath()); err == nil {
9898

99-
caBytes, err = ioutil.ReadFile(cfg.GetVaultCertPath())
99+
caBytes, err = os.ReadFile(cfg.GetVaultCertPath())
100100
if err != nil {
101101
return nil, errors.New(fmt.Sprintf("unable to read %v, error %v", cfg.GetVaultCertPath(), err))
102102
}

‎agreementbot/secrets/vault/init.go

+5-4
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,11 @@ import (
44
"encoding/json"
55
"errors"
66
"fmt"
7+
"io"
8+
"net/http"
9+
710
"github.com/golang/glog"
811
"github.com/open-horizon/anax/config"
9-
"io/ioutil"
10-
"net/http"
1112
)
1213

1314
// This function is called by the anax main to allow the plugin a chance to initialize itself.
@@ -57,7 +58,7 @@ func (vs *AgbotVaultSecrets) Login() (err error) {
5758
}
5859

5960
// Save the login token
60-
respBytes, err := ioutil.ReadAll(resp.Body)
61+
respBytes, err := io.ReadAll(resp.Body)
6162
if err != nil {
6263
return errors.New(fmt.Sprintf("unable to read login response, error: %v", err))
6364
}
@@ -111,7 +112,7 @@ func (vs *AgbotVaultSecrets) Renew() (err error) {
111112

112113
// Save the token locally
113114

114-
_, err = ioutil.ReadAll(resp.Body)
115+
_, err = io.ReadAll(resp.Body)
115116
if err != nil {
116117
return errors.New(fmt.Sprintf("unable to read renew response, error: %v", err))
117118
}

‎agreementbot/secrets/vault/vault.go

+11-10
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,15 @@ import (
44
"encoding/json"
55
"errors"
66
"fmt"
7+
"io"
8+
"net/http"
9+
"strings"
10+
711
"github.com/golang/glog"
812
"github.com/open-horizon/anax/agreementbot/secrets"
913
"github.com/open-horizon/anax/cli/cliutils"
1014
"github.com/open-horizon/anax/config"
1115
"github.com/open-horizon/anax/cutil"
12-
"io/ioutil"
13-
"net/http"
14-
"strings"
1516
)
1617

1718
// This function registers an uninitialized agbot secrets implementation with the secrets plugin registry. The plugin's Initialize
@@ -85,7 +86,7 @@ func (vs *AgbotVaultSecrets) listSecret(user, token, org, name, url string) erro
8586
}
8687

8788
// parse the vault response
88-
respBytes, err := ioutil.ReadAll(resp.Body)
89+
respBytes, err := io.ReadAll(resp.Body)
8990
if err != nil {
9091
return &secrets.InvalidResponse{ReadError: err, HttpMethod: http.MethodGet, SecretPath: url}
9192
} else {
@@ -243,7 +244,7 @@ func (vs *AgbotVaultSecrets) listSecrets(user, token, org, url, path string, all
243244
}
244245

245246
// parse the vault response
246-
respBytes, err := ioutil.ReadAll(resp.Body)
247+
respBytes, err := io.ReadAll(resp.Body)
247248
if err != nil {
248249
return nil, &secrets.InvalidResponse{ReadError: err, HttpMethod: "LIST", SecretPath: url}
249250
} else {
@@ -356,7 +357,7 @@ func (vs *AgbotVaultSecrets) createSecret(user, token, org, vaultSecretName, url
356357
}
357358

358359
// parse the vault response
359-
respBytes, err := ioutil.ReadAll(resp.Body)
360+
respBytes, err := io.ReadAll(resp.Body)
360361
if err != nil {
361362
return &secrets.InvalidResponse{ReadError: err, HttpMethod: http.MethodPost, SecretPath: url}
362363
} else {
@@ -446,7 +447,7 @@ func (vs *AgbotVaultSecrets) deleteSecret(user, token, org, name, url string) er
446447
}
447448

448449
// parse the vault response
449-
respBytes, err := ioutil.ReadAll(resp.Body)
450+
respBytes, err := io.ReadAll(resp.Body)
450451
if err != nil {
451452
return &secrets.InvalidResponse{ReadError: err, HttpMethod: http.MethodDelete, SecretPath: url}
452453
} else {
@@ -539,7 +540,7 @@ func (vs *AgbotVaultSecrets) GetSecretDetails(user, token, org, secretUser, secr
539540
}
540541

541542
// parse the vault response
542-
respBytes, rerr := ioutil.ReadAll(resp.Body)
543+
respBytes, rerr := io.ReadAll(resp.Body)
543544
if rerr != nil {
544545
err = &secrets.InvalidResponse{ReadError: rerr, HttpMethod: http.MethodGet, SecretPath: url}
545546
return
@@ -634,7 +635,7 @@ func (vs *AgbotVaultSecrets) GetSecretMetadata(secretOrg, secretUser, secretNode
634635
}
635636

636637
// parse the vault response
637-
respBytes, rerr := ioutil.ReadAll(resp.Body)
638+
respBytes, rerr := io.ReadAll(resp.Body)
638639
if rerr != nil {
639640
err = &secrets.InvalidResponse{ReadError: rerr, HttpMethod: http.MethodGet, SecretPath: url}
640641
return
@@ -710,7 +711,7 @@ func (vs *AgbotVaultSecrets) loginUser(user, token, org string) (string, string,
710711
}
711712

712713
// Save the login token
713-
respBytes, err := ioutil.ReadAll(resp.Body)
714+
respBytes, err := io.ReadAll(resp.Body)
714715
if err != nil {
715716
return "", "", errors.New(fmt.Sprintf("unable to read login response: %v", err))
716717
}

‎agreementbot/secure_api.go

+13-12
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,12 @@ package agreementbot
1919
import (
2020
"encoding/json"
2121
"fmt"
22+
"io"
23+
"net/http"
24+
"os"
25+
"strings"
26+
"time"
27+
2228
"github.com/golang/glog"
2329
"github.com/gorilla/mux"
2430
"github.com/open-horizon/anax/agreementbot/persistence"
@@ -34,11 +40,6 @@ import (
3440
"github.com/open-horizon/anax/i18n"
3541
"github.com/open-horizon/anax/worker"
3642
"golang.org/x/text/message"
37-
"io/ioutil"
38-
"net/http"
39-
"os"
40-
"strings"
41-
"time"
4243
)
4344

4445
const UserTypeCred = "users"
@@ -272,7 +273,7 @@ func (a *SecureAPI) policyCompatibleNodeList(w http.ResponseWriter, r *http.Requ
272273
matchingNodes := []string{}
273274

274275
if user_ec, _, msgPrinter, ok := a.processExchangeCred("/compatibility/constraints/node", UserTypeCred, w, r); ok {
275-
body, _ := ioutil.ReadAll(r.Body)
276+
body, _ := io.ReadAll(r.Body)
276277
if len(body) == 0 {
277278
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
278279
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -350,7 +351,7 @@ func (a *SecureAPI) patternCompatibleNodeList(w http.ResponseWriter, r *http.Req
350351
matchingNodes := []string{}
351352

352353
if user_ec, _, msgPrinter, ok := a.processExchangeCred("/compatibility/patterns/node", UserTypeCred, w, r); ok {
353-
body, _ := ioutil.ReadAll(r.Body)
354+
body, _ := io.ReadAll(r.Body)
354355
if len(body) == 0 {
355356
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
356357
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -491,7 +492,7 @@ func (a *SecureAPI) policy_compatible(w http.ResponseWriter, r *http.Request) {
491492

492493
// check user cred
493494
if user_ec, _, msgPrinter, ok := a.processExchangeCred("/deploycheck/policycompatible", UserTypeCred, w, r); ok {
494-
body, _ := ioutil.ReadAll(r.Body)
495+
body, _ := io.ReadAll(r.Body)
495496
if len(body) == 0 {
496497
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
497498
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -624,7 +625,7 @@ func (a *SecureAPI) userinput_compatible(w http.ResponseWriter, r *http.Request)
624625
glog.V(5).Infof(APIlogString(fmt.Sprintf("/deploycheck/userinputcompatible called.")))
625626

626627
if user_ec, _, msgPrinter, ok := a.processExchangeCred("/deploycheck/userinputcompatible", UserTypeCred, w, r); ok {
627-
body, _ := ioutil.ReadAll(r.Body)
628+
body, _ := io.ReadAll(r.Body)
628629
if len(body) == 0 {
629630
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
630631
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -747,7 +748,7 @@ func (a *SecureAPI) secretbinding_compatible(w http.ResponseWriter, r *http.Requ
747748
glog.V(5).Infof(APIlogString(fmt.Sprintf("/deploycheck/secretbindingcompatible called.")))
748749

749750
if user_ec, exUser, msgPrinter, ok := a.processExchangeCred("/deploycheck/secretbindingcompatible", UserTypeCred, w, r); ok {
750-
body, _ := ioutil.ReadAll(r.Body)
751+
body, _ := io.ReadAll(r.Body)
751752
if len(body) == 0 {
752753
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
753754
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -909,7 +910,7 @@ func (a *SecureAPI) deploy_compatible(w http.ResponseWriter, r *http.Request) {
909910
glog.V(5).Infof(APIlogString(fmt.Sprintf("/deploycheck/deploycompatible called.")))
910911

911912
if user_ec, exUser, msgPrinter, ok := a.processExchangeCred("/deploycheck/deploycompatible", UserTypeCred, w, r); ok {
912-
body, _ := ioutil.ReadAll(r.Body)
913+
body, _ := io.ReadAll(r.Body)
913914
if len(body) == 0 {
914915
glog.Errorf(APIlogString(fmt.Sprintf("No input found.")))
915916
writeResponse(w, msgPrinter.Sprintf("No input found."), http.StatusBadRequest)
@@ -1305,7 +1306,7 @@ func (a *SecureAPI) secretsSetup(w http.ResponseWriter, r *http.Request) *Secret
13051306

13061307
func parseSecretDetails(w http.ResponseWriter, r *http.Request, msgPrinter *message.Printer) *secrets.SecretDetails {
13071308
var input secrets.SecretDetails
1308-
if body, err := ioutil.ReadAll(r.Body); err != nil {
1309+
if body, err := io.ReadAll(r.Body); err != nil {
13091310
glog.Errorf(APIlogString(fmt.Sprintf("Unable to read request body, error: %v.", err)))
13101311
writeResponse(w, msgPrinter.Sprintf("Unable to read request body, error: %v.", err), http.StatusInternalServerError)
13111312
return nil

‎api/api_int_test.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,6 @@ import (
77
"bytes"
88
"encoding/json"
99
"fmt"
10-
"io/ioutil"
1110
"net/http"
1211
"net/http/httptest"
1312
"net/url"
@@ -36,7 +35,7 @@ func handleResp(r *http.Response, expectedStatus int) ([]byte, error) {
3635

3736
defer r.Body.Close()
3837

39-
return ioutil.ReadAll(r.Body)
38+
return io.ReadAll(r.Body)
4039
}
4140

4241
func deserialArray(b []byte) ([]Attribute, error) {
@@ -70,7 +69,7 @@ func serial(t *testing.T, attrInput []byte) []byte {
7069
}
7170

7271
func setup() (string, *bolt.DB, error) {
73-
dir, err := ioutil.TempDir("", "api-attribute-")
72+
dir, err := io.TempDir("", "api-attribute-")
7473
if err != nil {
7574
return "", nil, err
7675
}

‎api/api_management.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,16 @@ package api
33
import (
44
"encoding/json"
55
"fmt"
6+
"io"
7+
"net/http"
8+
69
"github.com/golang/glog"
710
"github.com/gorilla/mux"
811
"github.com/open-horizon/anax/eventlog"
912
"github.com/open-horizon/anax/exchange"
1013
"github.com/open-horizon/anax/exchangecommon"
1114
"github.com/open-horizon/anax/persistence"
1215
"github.com/open-horizon/anax/version"
13-
"io/ioutil"
14-
"net/http"
1516
)
1617

1718
func (a *API) managementStatus(w http.ResponseWriter, r *http.Request) {
@@ -49,7 +50,7 @@ func (a *API) managementStatus(w http.ResponseWriter, r *http.Request) {
4950

5051
// Read in the HTTP body.
5152
var nmStatus exchangecommon.NodeManagementPolicyStatus
52-
body, _ := ioutil.ReadAll(r.Body)
53+
body, _ := io.ReadAll(r.Body)
5354
if err := json.Unmarshal(body, &nmStatus); err != nil {
5455
errorHandler(NewAPIUserInputError(fmt.Sprintf("Input body couldn't be deserialized to %v object: %v, error: %v", resource, string(body), err), "management status"))
5556
return

0 commit comments

Comments
 (0)