From ea77415cfe2cefe46ffce233076a1409abaa8df7 Mon Sep 17 00:00:00 2001 From: Will Browne Date: Fri, 10 Dec 2021 11:29:12 +0000 Subject: [PATCH] apply fix (#42969) --- pkg/plugins/plugins.go | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/pkg/plugins/plugins.go b/pkg/plugins/plugins.go index e6370a29e75c0..c7199c716ee88 100644 --- a/pkg/plugins/plugins.go +++ b/pkg/plugins/plugins.go @@ -491,15 +491,15 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) { } // nolint:gosec - // We can ignore the gosec G304 warning on this one because `plug.PluginDir` is based - // on plugin the folder structure on disk and not user input. - path := filepath.Join(plug.PluginDir, fmt.Sprintf("%s.md", strings.ToUpper(name))) + // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently + // use this with a prefix of the plugin's directory, which is set during plugin loading + path := filepath.Join(plug.PluginDir, mdFilepath(strings.ToUpper(name))) exists, err := fs.Exists(path) if err != nil { return nil, err } if !exists { - path = filepath.Join(plug.PluginDir, fmt.Sprintf("%s.md", strings.ToLower(name))) + path = filepath.Join(plug.PluginDir, mdFilepath(strings.ToLower(name))) } exists, err = fs.Exists(path) @@ -511,8 +511,8 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) { } // nolint:gosec - // We can ignore the gosec G304 warning on this one because `plug.PluginDir` is based - // on plugin the folder structure on disk and not user input. + // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently + // use this with a prefix of the plugin's directory, which is set during plugin loading data, err := ioutil.ReadFile(path) if err != nil { return nil, err @@ -520,6 +520,10 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) { return data, nil } +func mdFilepath(mdFilename string) string { + return filepath.Clean(filepath.Join("/", fmt.Sprintf("%s.md", mdFilename))) +} + // gets plugin filenames that require verification for plugin signing func collectPluginFilesWithin(rootDir string) ([]string, error) { var files []string