NotificationsYou must be signed in to change notification settings
Fork1k
Star11.2k

chore: set more explicit guards for serving bin files#19597

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

sreya merged 2 commits intomainfromblink/path-injection-sanitization

Aug 28, 2025

Merged

chore: set more explicit guards for serving bin files#19597

sreya merged 2 commits intomainfromblink/path-injection-sanitization

Aug 28, 2025

Conversation

Copy link

Collaborator

sreya commentedAug 27, 2025•
edited
Loading

This is done mainly to satisfy CodeQL, the code was already doing a pretty reasonable job.

site: sanitize bin metadata path before fs open

b06e6ef

Add explicit validation to guard against path injection when openingbin files: reject empty, dot, slashes, and invalid fs paths, and ensurename is a single basename. This is defense-in-depth to satisfy CodeQL(go/path-injection) and does not change intended behavior.Add a unit test covering invalid names and a valid case.Co-authored-by: sreya <4856196+sreya@users.noreply.github.com>