fix: resolve vulnerabilities detected by security scan#782
Closed
LuoPengcheng12138 wants to merge 9 commits intomainfrom
Closed
fix: resolve vulnerabilities detected by security scan#782LuoPengcheng12138 wants to merge 9 commits intomainfrom
LuoPengcheng12138 wants to merge 9 commits intomainfrom
Conversation
LuoPengcheng12138
requested review from
Wendong-Fan,
fengju0213 and
nitpicker55555
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| if not path_value: | ||
| return None | ||
| try: | ||
| resolved = Path(path_value).expanduser().resolve() |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 5 months ago
The best fix is to sanitize all path components of user-supplied path_value before passing to Path(path_value). We can parse path_value as string, split into its components, and ensure each matches a safe pattern (e.g., via safe_component).
- In
sanitize_path()in utils/path_safety.py, before creating the Path object, split string paths and validate components except for known prefixes. - Only construct the Path object from sanitized components, then expanduser/resolve as before, and perform allowed_root containment check.
- Non-string path_values (Path objects) can be checked by iterating over components.
- This can all be implemented within
sanitize_path(); provide a helper if needed.
Suggested changeset
1
utils/path_safety.py
| @@ -2,6 +2,7 @@ | ||
|
|
||
| from pathlib import Path | ||
| import re | ||
| import os | ||
| from typing import Pattern | ||
|
|
||
| # Default safe pattern for path components (alphanumeric, underscore, dot, dash) | ||
| @@ -23,7 +24,23 @@ | ||
| if not path_value: | ||
| return None | ||
| try: | ||
| resolved = Path(path_value).expanduser().resolve() | ||
| # Validate/sanitize path components before joining | ||
| if isinstance(path_value, str): | ||
| # Normalize path and split into components | ||
| # Remove possible leading slashes (avoid absolute path bypass) | ||
| split_components = Path(path_value).parts | ||
| # If the first component is a root "/", ignore it | ||
| if split_components and split_components[0] == os.sep: | ||
| split_components = split_components[1:] | ||
| # Validate each component | ||
| safe_parts = [safe_component(comp, f"path component {i}") for i, comp in enumerate(split_components)] | ||
| sanitized_path = Path(*safe_parts) | ||
| elif isinstance(path_value, Path): | ||
| safe_parts = [safe_component(comp, f"path component {i}") for i, comp in enumerate(path_value.parts)] | ||
| sanitized_path = Path(*safe_parts) | ||
| else: | ||
| return None | ||
| resolved = (allowed_root / sanitized_path).expanduser().resolve() | ||
| resolved.relative_to(allowed_root) | ||
| return resolved | ||
| except Exception: |
Copilot is powered by AI and may make mistakes. Always verify output.
LuoPengcheng12138
removed request for
Wendong-Fan,
fengju0213 and
nitpicker55555
…ensitive information Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
LuoPengcheng12138
requested review from
Wendong-Fan,
fengju0213 and
nitpicker55555
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Scan the project and fix issues using the CodeQL tool.
https://githubdocs.cn/en/code-security/codeql-cli/getting-started-with-the-codeql-cli/about-the-codeql-cli
What is the purpose of this pull request?