(security) Path Traversal

[merelcht]

Description

Flagged by Snyk as Medium priority

Context

https://github.com/kedro-org/kedro/blob/main/kedro/framework/project/__init__.py#L218-L220

Possible Implementation

[ankatiyar]

Summary

In discussion with @noklam and @merelcht -

The only way to silence the Snyk warning is to check the path provided by the env variable KEDRO_LOGGING_CONFIG is inside a "safe directory". This isn't very easy to solve since we don't know in advance where the user's logging.yml will be.
Even if we could assume that the logging config file is within the project(project_path) or in the conf_source but those values are accessible when a session is created which happens much later after the logging has been set up. Also, with the addition of the ability of specifying conf-source, the conf is not necessarily located in the project and/or could be a zip/tar file.

The decision then is to make no changes to address this but rely on the user to make sure that the path to the logging file is not arbitrary.

[noklam]

To supplement this. it's fair to say that it's the user's responsibility to make sure they use a trusted file for the logging. If the Kedro pipeline is exposed via API or embedded in application. We recommend not to expose KEDRO_LOGGING_CONFIG to any external input to avoid this potential vulnerability.