Skip to content

Commit 1f358e8

Browse files
committed
Clean filepath before reading the content
Looks like security job is failing because it detect unsanitized input from file, this should fix following ``` ✗ [Medium] Path Traversal ID: 2ce4a8d7-4fb1-41b5-8841-dc76ea48e503 Path: pkg/crc/machine/bundle/repository.go, line 41 Info: Unsanitized input from file name flows into os.ReadFile, where it is used as a path. This may result in a Path Traversal vulnerability and allow an attacker to read arbitrary files. ```
1 parent a198680 commit 1f358e8

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

pkg/crc/machine/bundle/repository.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ func (repo *Repository) Get(bundleName string) (*CrcBundleInfo, error) {
3838
return nil, errors.Wrapf(err, "could not find cached bundle info in %s", path)
3939
}
4040
jsonFilepath := filepath.Join(path, metadataFilename)
41-
content, err := os.ReadFile(jsonFilepath)
41+
content, err := os.ReadFile(filepath.Clean(jsonFilepath))
4242
if err != nil {
4343
return nil, errors.Wrapf(err, "error reading %s file", jsonFilepath)
4444
}

0 commit comments

Comments
 (0)