fix: sanitize inspect output path#4793
Merged
AustinAbro321 merged 2 commits intomainfrom Apr 8, 2026
Merged
Conversation
Signed-off-by: Austin Abro <austinabro321@gmail.com>
✅ Deploy Preview for zarf-docs canceled.
|
Codecov Report❌ Patch coverage is
... and 3 files with indirect coverage changes 🚀 New features to boost your workflow:
|
dgershman
previously approved these changes
Apr 8, 2026
Contributor
dgershman
left a comment
There was a problem hiding this comment.
Code & Security Review
Critical Issues
None.
Security Review
Strengths:
- Correctly fixes a path traversal vulnerability where a maliciously crafted package name (e.g.,
../../etc/evil) could write SBOM or documentation files outside the intended output directory. filepath.Base()is the right mitigation — it strips all directory components, preventing traversal while preserving the actual name.- Fix is applied consistently across all three affected call sites:
src/cmd/package.go— SBOM inspect output pathsrc/cmd/package.go— documentation inspect output pathsrc/pkg/packager/create.go— SBOM output during package create
Minor Observation:
filepath.Base("")returns".", which would produce an output path likeoutputDir/.— but an empty package name is an edge case that would likely be caught by other validation. Not a blocking issue.- No test is added for the sanitization. A unit test verifying that a name like
../../traversalis sanitized totraversalwould strengthen confidence, but the fix itself is straightforward enough that this isn't blocking.
Code Quality
- Clean, minimal change with appropriate comments explaining the "why."
- No unnecessary refactoring.
Summary Table
| Priority | Issue |
|---|---|
| 🟢 Green | Consider adding a test for path traversal sanitization |
| 🟢 Green | Edge case: empty package name produces "." via filepath.Base("") (unlikely in practice) |
Recommendation: Approve — the fix is correct, minimal, and consistently applied across all affected paths.
Signed-off-by: Austin Abro <austinabro321@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This prevents package name that's been edited to go an arbitrary directory from leaving the cwd when using
zarf package inspect definitionorzarf package inspect sbomChecklist before merging