medlogic
/
olivetin
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: GHSA-364q-w7vh-vhpc (HIGH) Unsafe parsing of UniqueTrackingId can be used to write files

This commit is contained in:
jamesread 2026-03-08 23:29:00 +00:00
parent 24e8b48dc9
commit 2f77000de4
1 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
service/internal/executor/executor.go
View File

@ -20,6 +20,7 @@ import (
"os" "os"
"os/exec" "os/exec"
"path" "path"
"regexp"
"strings" "strings"
"sync" "sync"
"time" "time"
@ -30,6 +31,14 @@ const (
MaxTriggerDepth = 10 MaxTriggerDepth = 10
) )
var validTrackingIDPattern = regexp.MustCompile(`^[a-fA-F0-9\-]+$`)
func isValidTrackingID(id string) bool {
const MaxTrackingIDLength = 36
return id != "" && len(id) <= MaxTrackingIDLength && validTrackingIDPattern.MatchString(id)
}
var ( var (
metricActionsRequested = promauto.NewCounter(prometheus.CounterOpts{ metricActionsRequested = promauto.NewCounter(prometheus.CounterOpts{
Name: "olivetin_actions_requested_count", Name: "olivetin_actions_requested_count",
@ -506,8 +515,7 @@ func (e *Executor) ExecRequest(req *ExecutionRequest) (*sync.WaitGroup, string)
} }
_, isDuplicate := e.GetLog(req.TrackingID) _, isDuplicate := e.GetLog(req.TrackingID)
if isDuplicate || !isValidTrackingID(req.TrackingID) {
if isDuplicate || req.TrackingID == "" {
req.TrackingID = uuid.NewString() req.TrackingID = uuid.NewString()
} }