hanzoai/deploy
2
0
Fork 0
mirror of https://github.com/hanzoai/deploy.git synced 2026-10-07 08:44:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(commit-server): use os.Root for traversal protection (#22956)

Browse Source 
Signed-off-by: Michael Crenshaw <[email protected]>
This commit is contained in:
Michael Crenshaw
2025-06-09 10:09:21 -04:00
committed by GitHub
parent 20097fb724
commit e9b705ec2d
3 changed files with 99 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
commitserver/commit/commit.go
+8 -1
View File
@@ -12,6 +12,7 @@ import (
"github.com/argoproj/argo-cd/v3/commitserver/apiclient"
"github.com/argoproj/argo-cd/v3/commitserver/metrics"
"github.com/argoproj/argo-cd/v3/util/git"
"github.com/argoproj/argo-cd/v3/util/io"
"github.com/argoproj/argo-cd/v3/util/io/files"
)
@@ -97,6 +98,12 @@ func (s *Service) handleCommitRequest(logCtx *log.Entry, r *apiclient.CommitHydr
}
defer cleanup()
root, err := os.OpenRoot(dirPath)
if err != nil {
return "", "", fmt.Errorf("failed to open root dir: %w", err)
}
defer io.Close(root)
logCtx.Debugf("Checking out sync branch %s", r.SyncBranch)
var out string
out, err = gitClient.CheckoutOrOrphan(r.SyncBranch, false)
@@ -117,7 +124,7 @@ func (s *Service) handleCommitRequest(logCtx *log.Entry, r *apiclient.CommitHydr
}
logCtx.Debug("Writing manifests")
err = WriteForPaths(dirPath, r.Repo.Repo, r.DrySha, r.Paths)
err = WriteForPaths(root, r.Repo.Repo, r.DrySha, r.Paths)
if err != nil {
return "", "", fmt.Errorf("failed to write manifests: %w", err)
}