Nuclio Path Traversal (CWE-22) Fix: isPathInsideDir guard, GHSA-wpcj-rmv4-85qq

Key Vulnerability Information Summary Vulnerability Overview Title: [Security] Prevent path traversal in spec.handler source-code write #4143 Type: Path Traversal vulnerability Status: Merged, merged into the branch by on June 2nd Root Cause: In the Nuclio Dashboard's default NOP authentication mode, the field lacked module path validation. Attackers could construct paths using sequences such as within , causing the written byte stream to land outside the build directory (CWE-22) Scope of Impact Affected Components: - in - in Affected Scenarios: - Legitimate values (e.g., ) resolve directly under and are unaffected - Malicious or malformed module names (containing etc.) previously could escape ; this has now been fixed Unaffected: The field (shared at runtime by golang/shell processors, acting as the "weak layer" for this vulnerability) Fix Details 1. : Added , which resolves both parameters to absolute paths and uses to determine if is strictly inside (handling and name prefixes in a case-insensitive manner) 2. : In , a guard check was added for the source path before writing—if the source path resolves outside the build directory, the write operation is rejected Testing and Verification : Table-driven unit tests covering (subdirectories, self, parent directory, escape, case-insensitive prefixes) : Regression tests verifying that the guard is integrated into the source code write path and that escape paths such as are rejected; legitimate handlers were also confirmed to remain unaffected All checks passed (17 checks passed) References External Link: (CVSS 3.1 High, CWE-22) Related Issue: Related Citations This PR is cited by the following PRs/Issues: - (Merged) - (Closed)

Goal Reached Thanks to every supporter — we hit 100%!

Nuclio Path Traversal (CWE-22) Fix: isPathInsideDir guard, GHSA-wpcj-rmv4-85qq

More from this source