mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-08 17:39:09 -10:00
Dwi SiswantoandMzack9999
20cbf0bd73
* feat(filepath): add IsPathWithinAnyDirectory func Signed-off-by: Dwi Siswanto <[email protected]> * refactor: use path-aware filesystem containment checks Several filesystem trust boundaries relied on lexical prefix checks to decide whether a path fell under an allowed directory. That let sibling paths be treated as if they were children of trusted directories. Replace those checks with canonical path containment checks for helper payload loading, template archive extraction, custom template metadata, template path classification, and headless screenshot output validation. Signed-off-by: Dwi Siswanto <[email protected]> * adding more tests * fixing tests * adding test --------- Signed-off-by: Dwi Siswanto <[email protected]> Co-authored-by: Mzack9999 <[email protected]>
30 lines
921 B
Go
30 lines
921 B
Go
package utils
|
|
|
|
import (
|
|
"path/filepath"
|
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/keys"
|
|
filepathutil "github.com/projectdiscovery/nuclei/v3/pkg/utils/filepath"
|
|
)
|
|
|
|
const (
|
|
// TemplatesRepoURL is the URL for files in nuclei-templates repository
|
|
TemplatesRepoURL = "https://cloud.projectdiscovery.io/public/"
|
|
)
|
|
|
|
// TemplatePathURL returns the Path and URL for the provided template
|
|
func TemplatePathURL(fullPath, templateId, templateVerifier string) (path string, url string) {
|
|
configData := config.DefaultConfig
|
|
if configData.TemplatesDirectory != "" && filepathutil.IsPathWithinDirectory(fullPath, configData.GetTemplateDir()) {
|
|
relPath, err := filepath.Rel(configData.GetTemplateDir(), fullPath)
|
|
if err == nil && relPath != "." {
|
|
path = relPath
|
|
}
|
|
}
|
|
if templateVerifier == keys.PDVerifier {
|
|
url = TemplatesRepoURL + templateId
|
|
}
|
|
return
|
|
}
|