mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-09 12:21:25 -10:00
Dwi SiswantoandMzack9999
20cbf0bd73
* feat(filepath): add IsPathWithinAnyDirectory func Signed-off-by: Dwi Siswanto <[email protected]> * refactor: use path-aware filesystem containment checks Several filesystem trust boundaries relied on lexical prefix checks to decide whether a path fell under an allowed directory. That let sibling paths be treated as if they were children of trusted directories. Replace those checks with canonical path containment checks for helper payload loading, template archive extraction, custom template metadata, template path classification, and headless screenshot output validation. Signed-off-by: Dwi Siswanto <[email protected]> * adding more tests * fixing tests * adding test --------- Signed-off-by: Dwi Siswanto <[email protected]> Co-authored-by: Mzack9999 <[email protected]>
29 lines
833 B
Go
29 lines
833 B
Go
package utils
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
|
|
)
|
|
|
|
func TestTemplatePathURLUsesTemplateDirBoundaries(t *testing.T) {
|
|
templatesDir := filepath.Join(t.TempDir(), "nuclei-templates")
|
|
|
|
oldTemplatesDir := config.DefaultConfig.TemplatesDirectory
|
|
config.DefaultConfig.SetTemplatesDir(templatesDir)
|
|
t.Cleanup(func() {
|
|
config.DefaultConfig.SetTemplatesDir(oldTemplatesDir)
|
|
})
|
|
|
|
path, _ := TemplatePathURL(filepath.Join(templatesDir, "http", "test.yaml"), "test", "")
|
|
if path != filepath.Join("http", "test.yaml") {
|
|
t.Fatalf("expected relative template path, got %q", path)
|
|
}
|
|
|
|
path, _ = TemplatePathURL(filepath.Join(templatesDir+"-evil", "test.yaml"), "test", "")
|
|
if path != "" {
|
|
t.Fatalf("expected sibling prefix path not to be relativized, got %q", path)
|
|
}
|
|
}
|