-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
fixing payload load #3927
fixing payload load #3927
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm !
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
if !(templatePathDir != "/" && strings.HasPrefix(pt, templatePathDir)) && !strings.HasPrefix(pt, templateDirectory)
above code is used to restrict access
- if payload file is not in template directory
- if payload file is not in directory where template is present
@Mzack9999 i am not sure but i think we need to test this in windows enviornment to verify if this is working properly since the root path here is /
but root path is different for windows distro and also https://pkg.go.dev/vuln/GO-2023-1568
@tarunKoyalwar I think we need to add a function in utils package that given a path, perform cross-platform check from a list of allowed directories. Will create a ticket for that, meanwhile we can temporary merge this upon @Ice3man543 confirmation. |
Proposed changes
-sandbox
option, now divided into two new options shared below.Checklist