fix: prevent path injection vulnerability in site.go

sreya · sreya · commit da48d4255576 · 2025-08-04T00:10:12.000Z
Adds comprehensive path validation to prevent path traversal attacks
in the binMetadataCache.getMetadata function. The fix includes:

- Validation against path separators (/ and \)
- Prevention of path traversal sequences (..)
- Blocking of null bytes and hidden files
- Ensuring cleaned paths match original input

Fixes CodeQL vulnerability go/path-injection at line 1048.

Co-authored-by: sreya &lt;4856196+sreya@users.noreply.github.com&gt;
diff --git a/site/site.go b/site/site.go
@@ -1032,7 +1032,48 @@ func newBinMetadataCache(binFS http.FileSystem, binSha1Hashes map[string]string)
 	return b
 }
 
+// validateFileName ensures the file name is safe and doesn't contain path traversal sequences
+func validateFileName(name string) error {
+	// Check for empty or root path
+	if name == "" || name == "/" {
+		return os.ErrNotExist
+	}
+
+	// Check for any path separators (both forward and back slashes)
+	if strings.ContainsAny(name, "/\\") {
+		return os.ErrNotExist
+	}
+
+	// Check for path traversal sequences
+	if strings.Contains(name, "..") {
+		return os.ErrNotExist
+	}
+
+	// Check for null bytes
+	if strings.Contains(name, "\x00") {
+		return os.ErrNotExist
+	}
+
+	// Ensure the cleaned path equals the original (prevents encoded traversal)
+	cleaned := filepath.Clean(name)
+	if cleaned != name {
+		return os.ErrNotExist
+	}
+
+	// Additional check: ensure the name doesn't start with a dot (hidden files)
+	if strings.HasPrefix(name, ".") {
+		return os.ErrNotExist
+	}
+
+	return nil
+}
+
 func (b *binMetadataCache) getMetadata(name string) (binMetadata, error) {
+	// Validate the file name to prevent path traversal attacks
+	if err := validateFileName(name); err != nil {
+		return binMetadata{}, err
+	}
+
 	b.mut.RLock()
 	metadata, ok := b.metadata[name]
 	b.mut.RUnlock()
