Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

zap.Open: Invalidate relative paths and paths with ".." segments #1397

Closed
wants to merge 1 commit into from
Closed

zap.Open: Invalidate relative paths and paths with ".." segments #1397

wants to merge 1 commit into from

Commits on Dec 18, 2023

  1. zap.Open: Invalidate relative paths and paths with ".." segments 

    Currently, zap.Open doesn't prevent someone from explicitly doing something
like zap.Open("file://../../../secret").

zap.Open already documents that paths passed to it must be absolute. Add
validation to error if zap.Open is called with a relative paths that could
write files outside of intended file directory hierarchy.

This change addresses https://cwe.mitre.org/data/definitions/23.html

ref #1390
    @r-hang
    r-hang committed Dec 18, 2023
    Configuration menu
    Copy the full SHA
    332853b View commit details
    Browse the repository at this point in the history