search

OWASP / Nettacker

Automated Penetration Testing Framework - Open-Source Vulnerability Scanner - Vulnerability Management
https://owasp.org/www-project-nettacker/
Apache License 2.0
3.63k stars 780 forks source link

Fix code scanning alert no. 28: Uncontrolled data used in path expression #932

Closed arkid15r closed 1 month ago

arkid15r commented 1 month ago

Fixes https://github.com/OWASP/Nettacker/security/code-scanning/28

To fix the problem, we need to ensure that the filename parameter is securely validated before being used to access the file system. The best way to do this is to:

  1. Normalize the path to remove any relative path components.
  2. Ensure that the resulting path is within the intended directory by comparing the common prefix of the normalized path and the base directory.

We will modify the get_file function to include these steps.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.