sneak/secret
1
0
Fork 1
Code Issues 1 Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Validate secret name in GetSecretVersion to prevent path traversal (closes #13) #15

Merged
sneak merged 5 commits from clawbot/secret:fix/issue-13 into main 2026-02-20 08:56:51 +01:00
Conversation 4 Commits 5 Files Changed 2 +1
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit dc225bd0b1 - Show all commits

1
internal/vault/secrets.go
View File

@ -329,6 +329,7 @@ func (v *Vault) GetSecretVersion(name string, version string) ([]byte, error) {
// Validate secret name to prevent path traversal // Validate secret name to prevent path traversal
if !isValidSecretName(name) { if !isValidSecretName(name) {
secret.Debug("Invalid secret name provided", "secret_name", name) secret.Debug("Invalid secret name provided", "secret_name", name)
return nil, fmt.Errorf("invalid secret name '%s': must match pattern [a-z0-9.\\-_/]+", name) return nil, fmt.Errorf("invalid secret name '%s': must match pattern [a-z0-9.\\-_/]+", name)
} }