Prevent path traversal in sqlite file name#929
Conversation
Previously someone could set their db file name to something like `../ldk-node.sqlite` and we would accept this as a file path and write the databse in the parent directory. This can cause issues so we now only allow for normal file names. This still does allow for sub dirs, ie setting your db name to `mysubdir/ldk-node.sqlite` and it'll go into the sub directory `mysubdir`. I didn't want to disallow this people may be using this today and doesn't seem explicity bad like the parent dir traversal. Issue found by project-loupe. Codex was used to help write this.
|
I've assigned @tnull as a reviewer! |
|
🔔 1st Reminder Hey @tnull! This PR has been waiting for your review. |
|
🔔 2nd Reminder Hey @tnull! This PR has been waiting for your review. |
tnull
left a comment
tnull
left a comment
There was a problem hiding this comment.
I mean configuring SQLite should never be a public-facing API, and we can't guard against all cases of the operator messing up. Closing this as a wontfix, but feel free to reopen if you think this is worth the noise.
3 participants
Previously someone could set their db file name to something like
../ldk-node.sqliteand we would accept this as a file path and write the databse in the parent directory. This can cause issues so we now only allow for normal file names. This still does allow for sub dirs, ie setting your db name tomysubdir/ldk-node.sqliteand it'll go into the sub directorymysubdir. I didn't want to disallow this people may be using this today and doesn't seem explicity bad like the parent dir traversal.This finding was discovered by Project Loupe.
Codex was used to help write this.