Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Validating Log File Path for cli function #1115

Conversation

rajithkrishnegowda
Copy link
Collaborator

Fixing 656290 Filesystem path, filename, or URI manipulation

Screenshot 2024-11-04 at 2 01 35 PM

Changes:

  • Path Normalization: Added os.path.normpath(log_file) to normalize the log file path.
  • Regular Expression Validation: Updated the regular expression to ensure the log file is within the logs directory and contains only allowed characters.
  • Additional Security Checks:
    1. Ensured the log file path does not contain .. or start with /.
    2. Used pathlib to handle paths more securely.
    3. Verified that the resolved log file path is within the allowed directory.

@rajithkrishnegowda rajithkrishnegowda force-pushed the fix-Filesystem-path-manipulation-issue branch from 90da8f0 to 71c6d2d Compare November 4, 2024 08:32
@teoparvanov teoparvanov merged commit ef65d9c into securefederatedai:develop Nov 4, 2024
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants