Potential fix for code scanning alert no. 65: Uncontrolled data used in path expression#344
Merged
Potential fix for code scanning alert no. 65: Uncontrolled data used in path expression#344
Conversation
…in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Hardens bundle.Import archive extraction to address a code scanning alert about uncontrolled data in path expressions by tightening path traversal and destination confinement checks during tar.gz import.
Changes:
- Normalize the destination directory once and use it as the basis for path joining.
- Add stricter validation for cleaned tar entry paths (reject absolute paths and parent directory references).
- Verify the final computed destination path remains within the intended destination directory before writing.
Comment on lines
24
to
29
| if err := os.MkdirAll(destDir, 0750); err != nil { | ||
| return nil, "", fmt.Errorf("create dest dir: %w", err) | ||
| } | ||
| // Normalise the destination directory once for safe prefix checks. | ||
| absDestDir := filepath.Clean(destDir) | ||
|
|
Contributor
Author
|
@copilot open a new pull request to apply changes based on the comments in this thread |
Contributor
…ment check (#345) * Initial plan * Fix bundle.Import: skip dot entries, use filepath.Abs for destDir Co-authored-by: intel352 <77607+intel352@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: intel352 <77607+intel352@users.noreply.github.com>
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Potential fix for https://github.com/GoCodeAlone/workflow/security/code-scanning/65
In general, to fix uncontrolled-path issues when extracting archives, you should (1) normalize the entry path, (2) reject any path that attempts to escape the intended root, and (3) ensure the final destination path is still inside the trusted directory after joining and resolving it. That means you should not only inspect the archive entry string, but also verify the resolved
destPathagainst the trusted root.For this specific code, the best fix without changing functionality is to tighten the path validation in
bundle.Importinbundle/import.go. After computingclean := filepath.Clean(hdr.Name), we should (a) ensure it is not empty, (b) reject any entry that is.or contains".."path components, and (c) after computingdestPath := filepath.Join(destDir, clean), verify that the cleaneddestPathis still within the (cleaned)destDirusing a prefix check that accounts for path separators. This ensures that even unusual relative paths or platform-specific separators cannot escapedestDir. Once this is done,workflowPath—which is set only whenclean == "workflow.yaml"—is guaranteed to be a path to a file insidedestDir, makingos.ReadFile(workflowPath)safe.Concretely:
bundle/import.go, extend the validation right afterfilepath.Clean(hdr.Name)to rejectclean == ".", anycleanthat contains".."as a path component, and then, afterdestPath := filepath.Join(destDir, clean), computeabsDestDir := filepath.Clean(destDir)andabsDestPath := filepath.Clean(destPath)once, and ensureabsDestPathhasabsDestDiras a prefix followed by a path separator or equals it. If not, return an error likeinvalid path in bundle.absDestDirfor every file, compute it once near the top ofImportafter successfully creatingdestDir.module/api_v1_handler.go; we only makeImportstrictly confine extracted paths todestDir, which keeps existing behavior (extracting into that workspace) while hardening against traversal.No new external dependencies are required; we can use
strings.HasPrefixandos.PathSeparatorfrom the standard library.Suggested fixes powered by Copilot Autofix. Review carefully before merging.