diff options
| author |  Yong Tang <yong.tang.github@outlook.com>
| 2022-02-14 08:24:21 -0800 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2022-02-14 11:24:21 -0500 |
| commit | c6709d930f71d64dc3b5d1a15943e5c927e808cc (patch) | |
| tree | 2816c901cdfcc3818c43a3bc972e5804a90ca34a /plugin/sign/signer.go | |
| parent | b40f2a0a44316ed91bbc5f42fe03819c0f1f98a7 (diff) | |
| download | coredns-c6709d930f71d64dc3b5d1a15943e5c927e808cc.tar.gz coredns-c6709d930f71d64dc3b5d1a15943e5c927e808cc.tar.zst coredns-c6709d930f71d64dc3b5d1a15943e5c927e808cc.zip | |
Fix security scans by cleaning up file path (#5185)
While performing security scans there were several
issue raised as G304 (CWE-22): Potential file inclusion via variable.
As some files path are taken from user input, it is possible the
filepath passed by user may have unintended effect if not properly formed.
This fix add Clean to remove the security warning and address some
potential issue.
Signed-off-by: Yong Tang <yong.tang.github@outlook.com>
Diffstat (limited to 'plugin/sign/signer.go')
| -rw-r--r-- | plugin/sign/signer.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/plugin/sign/signer.go b/plugin/sign/signer.go index d1ea22356..95ce94b52 100644 --- a/plugin/sign/signer.go +++ b/plugin/sign/signer.go @@ -111,7 +111,7 @@ func (s *Signer) Sign(now time.Time) (*file.Zone, error) { // resign checks if the signed zone exists, or needs resigning. func (s *Signer) resign() error { signedfile := filepath.Join(s.directory, s.signedfile) - rd, err := os.Open(signedfile) + rd, err := os.Open(filepath.Clean(signedfile)) if err != nil && os.IsNotExist(err) { return err } |