stacklok / toolhive / 27282426364

push

github

Prevent path traversal in LocalStore.getFilePath (#5464)

getFilePath constructed file paths with filepath.Join but never
verified the result stayed within basePath. A name like
"../../../etc/passwd" would resolve outside the state directory,
making GetReader, GetWriter, CreateExclusive, Delete, and Exists
all vulnerable to path traversal.

Fix: after filepath.Join (which calls filepath.Clean to resolve ".."
components), check that the result starts with basePath+separator
using the same containment pattern already established in
pkg/fileutils/contained.go. Update the #nosec G304 comments to
reflect that the check is now actually enforced.

Closes #4736

29 of 29 new or added lines in 1 file covered. (100.0%)

67293 of 101516 relevant lines covered (66.29%)

63.14 hits per line