stacklok / toolhive / 27282426364

67%

Build Type

push

github

Committed by web-flow

Commit Message

Prevent path traversal in LocalStore.getFilePath (#5464)

getFilePath constructed file paths with filepath.Join but never
verified the result stayed within basePath. A name like
"../../../etc/passwd" would resolve outside the state directory,
making GetReader, GetWriter, CreateExclusive, Delete, and Exists
all vulnerable to path traversal.

Fix: after filepath.Join (which calls filepath.Clean to resolve ".."
components), check that the result starts with basePath+separator
using the same containment pattern already established in
pkg/fileutils/contained.go. Update the #nosec G304 comments to
reflect that the check is now actually enforced.

Closes #4736

Coverage Stats

29 of 29 new or added lines in 1 file covered. (100.0%)

12 existing lines in 3 files now uncovered.

67293 of 101516 relevant lines covered (66.29%)

63.14 hits per line