Security Fix: Path Traversal Prevention

Alert Number: #445
Severity: Medium
Rule: G304 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Vulnerability Description

The security scanner identified a path traversal vulnerability in pkg/cli/poutine.go at line 401. The code was reading files using os.ReadFile(filePath) where the filePath came from external JSON output from the poutine security scanning tool, without proper validation or sanitization.

This could potentially allow an attacker who compromises the poutine tool or its output to read arbitrary files outside the intended git repository directory through path traversal techniques (e.g., using ../ sequences).

Fix Applied

The fix implements comprehensive path validation and sanitization:

1. Path Normalization: Added filepath.Clean() to normalize the path and remove any .. or . elements
2. Absolute Path Resolution: Convert relative paths to absolute paths within the git root directory
3. Boundary Validation: Use filepath.Rel() to verify that the resolved path is within the git root directory
4. Safe Skipping: Skip files that fall outside the git root with appropriate logging

Changes Made

• Modified the function signature of parseAndDisplayPoutineOutputForDirectory to accept gitRoot parameter
• Updated the function call to pass the gitRoot parameter
• Added path validation logic before the os.ReadFile() call:
  • Sanitize the path using filepath.Clean()
  • Resolve to absolute path
  • Verify the file is within the git root using filepath.Rel()
  • Skip files outside the allowed directory

Security Best Practices

This fix follows the principle of least privilege and defense in depth:

• Input Validation: All file paths from external sources are validated before use
• Path Sanitization: Paths are normalized to prevent traversal sequences
• Boundary Checking: Files are verified to be within the expected directory
• Fail-Safe Defaults: Invalid paths are skipped rather than processed

Testing Considerations

• ✅ Code compiles successfully with go build
• The fix maintains backward compatibility with existing functionality
• Legitimate files within the git root continue to work as expected
• Files outside the git root are safely skipped with logging

Related Files

• pkg/cli/poutine.go: Main file with the security fix applied

AI generated by Security Fix PR