7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
52 lines
1.4 KiB
Go
52 lines
1.4 KiB
Go
package services
|
|
|
|
import (
|
|
"fmt"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
// SafeResolvePath resolves a user-supplied relative path within a base directory.
|
|
// Returns an error if the resolved path escapes the base directory (path traversal).
|
|
// The baseDir must be an absolute path.
|
|
func SafeResolvePath(baseDir, userInput string) (string, error) {
|
|
if userInput == "" {
|
|
return "", fmt.Errorf("empty path")
|
|
}
|
|
|
|
// Reject absolute paths
|
|
if filepath.IsAbs(userInput) {
|
|
return "", fmt.Errorf("absolute paths not allowed")
|
|
}
|
|
|
|
// Clean the user input to resolve . and .. components
|
|
cleaned := filepath.Clean(userInput)
|
|
|
|
// After cleaning, check if it starts with .. (escapes base)
|
|
if strings.HasPrefix(cleaned, "..") {
|
|
return "", fmt.Errorf("path traversal detected")
|
|
}
|
|
|
|
// Resolve the base directory to an absolute path
|
|
absBase, err := filepath.Abs(baseDir)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid base directory: %w", err)
|
|
}
|
|
|
|
// Join and resolve the full path
|
|
fullPath := filepath.Join(absBase, cleaned)
|
|
|
|
// Final containment check: the resolved path must be within the base directory
|
|
absFullPath, err := filepath.Abs(fullPath)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid resolved path: %w", err)
|
|
}
|
|
|
|
// Ensure the resolved path is strictly inside the base directory (not the base itself)
|
|
if !strings.HasPrefix(absFullPath, absBase+string(filepath.Separator)) {
|
|
return "", fmt.Errorf("path traversal detected")
|
|
}
|
|
|
|
return absFullPath, nil
|
|
}
|