newrelic / infrastructure-agent / 29091214812

54%

master: 54%

Build Type

Pull #2285

github

Committed by sairaj18

Commit Message

fix(security): contain inventory plugin writes to the plugin dir (NR-574888)

SavePluginSource concatenated the payload-controlled `term` (integration
`name`) directly into the on-disk path via fmt.Sprintf, unsanitised. A `../`
in `term` — reachable unauthenticated via the HTTP/TCP integration ingest
endpoints — let the (root) agent write attacker-controlled JSON to an
arbitrary path (path traversal -> root arbitrary file write; CWE-22/23/73).

Reject terms that are not a plain filename (path separators / ".." / unsafe
chars, via SanitizeFileName), build the path with filepath.Join, and add a
defence-in-depth containment check that the resolved path stays within the
plugin directory. Adds a regression test (fails against the unpatched sink).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #2285: fix(security): contain inventory plugin writes to the plugin dir (NR-574888)

Coverage Stats

12 of 14 new or added lines in 1 file covered. (85.71%)

2 existing lines in 1 file now uncovered.

14590 of 27196 relevant lines covered (53.65%)

17.91 hits per line