Validate secret name in GetSecretVersion to prevent path traversal (closes #13) #15

Merged

sneak merged 5 commits from clawbot/secret:fix/issue-13 into main

2026-02-20 08:56:51 +01:00

Author	SHA1	Message	Date
Jeffrey Paul	ebe3c17618	Merge branch 'main' into fix/issue-13	2026-02-20 08:56:36 +01:00
clawbot	dc225bd0b1	fix: add blank line before return for nlreturn linter	2026-02-19 23:44:38 -08:00
clawbot	6acd57d0ec	fix: suppress gosec G204 for validated GPG key ID inputs	2026-02-19 23:43:32 -08:00
user	8eb25b98fd	fix: block .. path components in secret names and validate in GetSecretObject - isValidSecretName() now rejects names with '..' path components (e.g. foo/../bar) - GetSecretObject() now calls isValidSecretName() before building paths - Added test cases for mid-path traversal patterns	2026-02-15 14:17:33 -08:00
clawbot	3fd30bb9e6	Validate secret name in GetSecretVersion to prevent path traversal Add isValidSecretName() check at the top of GetSecretVersion(), matching the existing validation in AddSecret(). Without this, crafted secret names containing path traversal sequences (e.g. '../../../etc/passwd') could be used to read files outside the vault directory. Add regression tests for both GetSecretVersion and GetSecret. Closes #13	2026-02-15 14:03:28 -08:00