config: add path validation #304
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
ffromani
force-pushed
the
validate-paths
branch
2 times, most recently
from
bf48a27 to
1361f01
Compare
ffromani
force-pushed
the
validate-paths
branch
from
1361f01 to
74312b1
Compare
Tal-or
reviewed
Nov 28, 2024
ffromani
force-pushed
the
validate-paths
branch
3 times, most recently
from
7071a48 to
3761b24
Compare
add validation and restrictions about configuration paths, to reduce the chance of path traversal vulnerabilities. Most notably: - config root path must be one of the allowed subpaths - configlet are expected not to escape the configuratio directories Signed-off-by: Francesco Romani <[email protected]>
ffromani
force-pushed
the
validate-paths
branch
from
3761b24 to
5dbc2c1
Compare
Signed-off-by: Francesco Romani <[email protected]>
This was referenced Dec 2, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
add validation and restrictions about configuration paths,
to reduce the chance of path traversal vulnerabilities.
Most notably:
directories