Third party filebrowser subject to path manipulation

EarthSystemCoG / COG

COG source code

BSD 3-Clause "New" or "Revised" License

8 stars 16 forks source link

Closed LucaCinquini closed 7 years ago

LucaCinquini commented 7 years ago

Who: NOAA security scan

The third-party filebrowser software that is used in CoG is susceptible to file path manipulation attackes in its open() and save() methods.

LucaCinquini commented 7 years ago

Those methods have been wrapped in a "validate_path()" method that checks for the presence of the infamous "." character.

murphysj commented 7 years ago

verified by code review.