validatePathComponents validates that path components don't contain malicious sequences
(owner, repo, path, sha string)
| 32 | |
| 33 | // validatePathComponents validates that path components don't contain malicious sequences |
| 34 | func validatePathComponents(owner, repo, path, sha string) error { |
| 35 | components := []string{owner, repo, path, sha} |
| 36 | for _, comp := range components { |
| 37 | // Check for empty components |
| 38 | if comp == "" { |
| 39 | importCacheLog.Print("Path validation failed: empty component detected") |
| 40 | return errors.New("empty component in path") |
| 41 | } |
| 42 | // Check for path traversal attempts |
| 43 | if strings.Contains(comp, "..") { |
| 44 | importCacheLog.Printf("Path validation failed: path traversal attempt in component: %s", comp) |
| 45 | return fmt.Errorf("component contains '..' sequence: %s", comp) |
| 46 | } |
| 47 | // Check for absolute paths |
| 48 | if filepath.IsAbs(comp) { |
| 49 | importCacheLog.Printf("Path validation failed: absolute path in component: %s", comp) |
| 50 | return fmt.Errorf("component is absolute path: %s", comp) |
| 51 | } |
| 52 | } |
| 53 | importCacheLog.Print("Path validation successful") |
| 54 | return nil |
| 55 | } |
| 56 | |
| 57 | // ImportCache manages cached imported workflow files |
| 58 | type ImportCache struct { |