Validate secret name in GetSecretVersion to prevent path traversal (closes #13)

+114

5 Коммитов

Автор	SHA1	Сообщение	Дата
sneak	ebe3c17618	Merge branch 'main' into fix/issue-13	2026-02-20 08:56:36 +01:00
clawbot	dc225bd0b1	fix: add blank line before return for nlreturn linter	2026-02-19 23:44:38 -08:00
clawbot	6acd57d0ec	fix: suppress gosec G204 for validated GPG key ID inputs	2026-02-19 23:43:32 -08:00
user	8eb25b98fd	fix: block .. path components in secret names and validate in GetSecretObject - isValidSecretName() now rejects names with '..' path components (e.g. foo/../bar) - GetSecretObject() now calls isValidSecretName() before building paths - Added test cases for mid-path traversal patterns	2026-02-15 14:17:33 -08:00
clawbot	3fd30bb9e6	Validate secret name in GetSecretVersion to prevent path traversal Add isValidSecretName() check at the top of GetSecretVersion(), matching the existing validation in AddSecret(). Without this, crafted secret names containing path traversal sequences (e.g. '../../../etc/passwd') could be used to read files outside the vault directory. Add regression tests for both GetSecretVersion and GetSecret. Closes #13	2026-02-15 14:03:28 -08:00

Validate secret name in GetSecretVersion to prevent path traversal (closes #13) #15