medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files

This commit is contained in:
jamesread 2026-03-08 23:29:00 +00:00
parent 24e8b48dc9
commit 2f77000de4
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
service/internal/executor/executor.go
View File

@ -20,6 +20,7 @@ import (
"os"
"os/exec"
"path"
"regexp"
"strings"
"sync"
"time"
@ -30,6 +31,14 @@ const (
MaxTriggerDepth = 10
)
var validTrackingIDPattern = regexp.MustCompile(`^[a-fA-F0-9\-]+$`)
func isValidTrackingID(id string) bool {
const MaxTrackingIDLength = 36
return id != "" && len(id) <= MaxTrackingIDLength && validTrackingIDPattern.MatchString(id)
}
var (
metricActionsRequested = promauto.NewCounter(prometheus.CounterOpts{
Name: "olivetin_actions_requested_count",
@ -506,8 +515,7 @@ func (e *Executor) ExecRequest(req *ExecutionRequest) (*sync.WaitGroup, string)
}
_, isDuplicate := e.GetLog(req.TrackingID)
if isDuplicate || req.TrackingID == "" {
if isDuplicate || !isValidTrackingID(req.TrackingID) {
req.TrackingID = uuid.NewString()
}