Change "script" to "launcher" in variables #3976
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| end.map do |script| | ||
| saved_successfully = script.save | ||
| errors.add(:save, script.errors.full_messages) unless saved_successfully | ||
| Dir.glob("#{dir}/*/form.yml").map do |launcher_yml| |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI about 1 month ago
To fix the problem, we need to ensure that the template attribute is properly validated and sanitized before being used to construct file paths. This can be achieved by implementing additional validation rules to restrict the format of the template attribute, ensuring it does not contain any directory traversal sequences or other potentially harmful characters.
- Add a custom validation method to sanitize the
templateattribute. - Update the
project_template_invalidmethod to include the new validation. - Ensure that the
templateattribute is sanitized before being used in thesave_new_launchersmethod.
| @@ -272,2 +272,3 @@ | ||
| def save_new_launchers | ||
| sanitize_template | ||
| dir = Launcher.launchers_dir(template) | ||
| @@ -310,2 +311,3 @@ | ||
|
|
||
| sanitize_template | ||
| template_path = Pathname.new(template) | ||
| @@ -314,2 +316,7 @@ | ||
| end | ||
|
|
||
| def sanitize_template | ||
| # Remove any directory traversal sequences and ensure the template is a valid directory name | ||
| self.template = template.gsub(/(\.\.\/|\/|\\)/, '') | ||
| end | ||
| end |
|
Given tests fail you may want to reduce the scope of the change to maybe 1 file at a time and pick this apart piecemeal. |
|
Tests pass but the naming of system tests should probably be updated and possibly something about this security vulnerability as well. |
Fixes #3921
Changes variables with
scriptin the name to instead saylauncherif actually referring to launchers.Updates user messages to reflect using launchers, not scripts.