🛡️ Sentinel: [CRITICAL] Fix Path Traversal in Snapshot Command#20
🛡️ Sentinel: [CRITICAL] Fix Path Traversal in Snapshot Command#20bitcoiner-dev wants to merge 1 commit intomasterfrom
Conversation
🚨 Severity: CRITICAL 💡 Vulnerability: User-provided `name` parameter in `SnapshotAction::Save` and `SnapshotAction::Restore` was not validated, allowing path traversal (e.g., `../`). Furthermore, `snapshot_dir` created the parent dir using standard `fs::create_dir_all` over the safe `create_secure_dir_all`. 🎯 Impact: Attackers or malicious users could read or write arbitrary files on the local filesystem outside of the snapshot directory via path traversal characters. 🔧 Fix: Added strict input validation using `validate_file_name` to allowlist only alphanumeric characters, dashes, and underscores in the `name` argument before using it to access the file system. In addition, replaced the insecure `fs::create_dir_all` with `create_secure_dir_all` inside the snapshot command to securely generate snapshot directories with restricted permissions. ✅ Verification: `cargo test` and `cargo clippy` passed locally, demonstrating regression-free functionality. Co-authored-by: bitcoiner-dev <75873427+bitcoiner-dev@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
1 participant
🚨 Severity: CRITICAL
💡 Vulnerability: User-provided
nameparameter inSnapshotAction::SaveandSnapshotAction::Restorewas not validated, allowing path traversal (e.g.,../). Furthermore,snapshot_dircreated the parent dir using standardfs::create_dir_allover the safecreate_secure_dir_all.🎯 Impact: Attackers or malicious users could read or write arbitrary files on the local filesystem outside of the snapshot directory via path traversal characters.
🔧 Fix: Added strict input validation using
validate_file_nameto allowlist only alphanumeric characters, dashes, and underscores in thenameargument before using it to access the file system. In addition, replaced the insecurefs::create_dir_allwithcreate_secure_dir_allinside the snapshot command to securely generate snapshot directories with restricted permissions.✅ Verification:
cargo testandcargo clippypassed locally, demonstrating regression-free functionality.PR created automatically by Jules for task 5825050222408733422 started by @bitcoiner-dev