1
54%
master: 54%

Ran 10 Jul 2026 12:06PM UTC

Files 339

Run time 13s

Badge

Embed ▾

Committed 10 Jul 2026 12:00PM UTC coverage: 53.648% (+0.07%) from 53.574%

Job # 29091214812.1

Build Type

Pull #2285

github

Committed by

sairaj18

Commit Message

fix(security): contain inventory plugin writes to the plugin dir (NR-574888)

SavePluginSource concatenated the payload-controlled `term` (integration
`name`) directly into the on-disk path via fmt.Sprintf, unsanitised. A `../`
in `term` — reachable unauthenticated via the HTTP/TCP integration ingest
endpoints — let the (root) agent write attacker-controlled JSON to an
arbitrary path (path traversal -> root arbitrary file write; CWE-22/23/73).

Reject terms that are not a plain filename (path separators / ".." / unsafe
chars, via SanitizeFileName), build the path with filepath.Join, and add a
defence-in-depth containment check that the resolved path stays within the
plugin directory. Adds a regression test (fails against the unpatched sink).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Pull Request Pull Request #2285: fix(security): contain inventory plugin writes to the plugin dir (NR-574888)

Coverage Stats

14590 of 27196 relevant lines covered (53.65%)

17.91 hits per line

newrelic / infrastructure-agent / 29091214812 / 1
54%
master: 54%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job run-linux - 29091214812.1

newrelic / infrastructure-agent / 29091214812 / 1 54% master: 54%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job run-linux - 29091214812.1

newrelic / infrastructure-agent / 29091214812 / 1
54%
master: 54%

README BADGES
x