Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

fixing payload load #3927

Merged
merged 6 commits into from
Jul 14, 2023
Merged

fixing payload load #3927

merged 6 commits into from
Jul 14, 2023

Conversation

Mzack9999
Copy link
Member

@Mzack9999 Mzack9999 commented Jul 13, 2023

Proposed changes

  • Removed -sandbox option, now divided into two new options shared below.
  • Added options to enable/disable file/network access.
   -lna, -restrict-local-network-access  blocks connections to the local / private network
   -lfa, -allow-local-file-access  allows file (payload) access anywhere on the system
  • Fixed issue with payloads feature in sandbox mode.

Checklist

  • Pull request is created against the dev branch
  • All checks passed (lint, unit/integration/regression tests etc.) with my changes
  • I have added tests that prove my fix is effective or that my feature works
  • I have added necessary documentation (if appropriate)

@Ice3man543 Ice3man543 marked this pull request as ready for review July 14, 2023 05:39
@ehsandeep ehsandeep mentioned this pull request Jul 14, 2023
4 tasks
Copy link
Member

@tarunKoyalwar tarunKoyalwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm !

Copy link
Member

@tarunKoyalwar tarunKoyalwar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if !(templatePathDir != "/" && strings.HasPrefix(pt, templatePathDir)) && !strings.HasPrefix(pt, templateDirectory)

above code is used to restrict access

  • if payload file is not in template directory
  • if payload file is not in directory where template is present

@Mzack9999 i am not sure but i think we need to test this in windows enviornment to verify if this is working properly since the root path here is / but root path is different for windows distro and also https://pkg.go.dev/vuln/GO-2023-1568

@Mzack9999
Copy link
Member Author

@tarunKoyalwar I think we need to add a function in utils package that given a path, perform cross-platform check from a list of allowed directories. Will create a ticket for that, meanwhile we can temporary merge this upon @Ice3man543 confirmation.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

enabling sandbox option as default
4 participants