sanitize cert path in config file

ooni / minivpn

A minimalistic OpenVPN implementation in Go

GNU General Public License v3.0

38 stars 6 forks source link

Closed ainghazal closed 1 year ago

ainghazal commented 2 years ago

to prevent a potential LFI, the path that is parsed for certificate material in the config file should:

be sanitized (use filepath.Clean())
is not a symlink
check that the absolute path is below the base dir (ie, the dir in which the config file is).

Overall, there're not so many things that can be exploited via this path, but it's good hygiene to sanitize our inputs.

ainghazal commented 1 year ago

this is addressed in #30