Description
The compare command's --save flag accepts a file path and saves the comparison report to that location without any validation or sanitization. An attacker or malicious user could provide a path like '../../sensitive-file.txt' to attempt writing outside the intended directory or overwriting system files. While file system permissions may prevent actual damage, the lack of validation violates secure coding practices.
Steps to Reproduce
- Run 'repo-lyzer compare repo1/repo1 repo2/repo2 --format html --save /tmp/../../etc/hosts'
- Observe that the application attempts to write to the path provided without validation
- If filesystem permissions are weak, the file could be written to an unexpected location
Environment Information
- Repo-lyzer CLI (Go-based)
- Affected command: compare
- Affected file: cmd/compare.go, lines 64-66
- Affected flag: --save
Expected Behavior
The --save flag should validate that the provided file path is within an acceptable directory. Path traversal sequences like '../' should be detected and rejected, or the path should be sanitized using filepath.Clean() and validated against a safe base directory.
Actual Behavior
The code accepts the savePath directly from the command flag without any validation or sanitization. Lines 64-66 retrieve the savePath and pass it directly to file writing functions without checking for path traversal sequences.
Code Reference
File: cmd/compare.go
Lines: 64-66
Function: RunE closure in compareCmd
Problematic code: savePath, _ := cmd.Flags().GetString('save'); (then used directly without validation)
Additional Context
Severity: Low-Medium. The risk depends on the filesystem permissions under which Repo-lyzer runs. In a shared system or container environment with loose permissions, this could lead to unintended file writes. Suggested fix: Validate savePath using filepath.Clean() and verify it is within an acceptable base directory. Reject paths containing '..' or absolute paths.
Suggested Labels
security, path-validation, input-validation
Program Template
Description
The compare command's --save flag accepts a file path and saves the comparison report to that location without any validation or sanitization. An attacker or malicious user could provide a path like '../../sensitive-file.txt' to attempt writing outside the intended directory or overwriting system files. While file system permissions may prevent actual damage, the lack of validation violates secure coding practices.
Steps to Reproduce
Environment Information
Expected Behavior
The --save flag should validate that the provided file path is within an acceptable directory. Path traversal sequences like '../' should be detected and rejected, or the path should be sanitized using filepath.Clean() and validated against a safe base directory.
Actual Behavior
The code accepts the savePath directly from the command flag without any validation or sanitization. Lines 64-66 retrieve the savePath and pass it directly to file writing functions without checking for path traversal sequences.
Code Reference
File: cmd/compare.go
Lines: 64-66
Function: RunE closure in compareCmd
Problematic code: savePath, _ := cmd.Flags().GetString('save'); (then used directly without validation)
Additional Context
Severity: Low-Medium. The risk depends on the filesystem permissions under which Repo-lyzer runs. In a shared system or container environment with loose permissions, this could lead to unintended file writes. Suggested fix: Validate savePath using filepath.Clean() and verify it is within an acceptable base directory. Reject paths containing '..' or absolute paths.
Suggested Labels
security, path-validation, input-validation
Program Template