lint: fix gosec G703 path traversal finding in deploy log download handler #177

New Issue

clawbot · 2026-08-07T18:40:39+02:00

clawbot commented

2026-08-07 18:40:39 +02:00

Surveyed 2026-08-07: golangci-lint 2.12.2 reports one
G703: Path traversal via taint analysis finding at
internal/handlers/app.go:629 — http.ServeFile called with a
logPath derived from request data:

filename := filepath.Base(logPath)
writer.Header().Set("Content-Type", "text/plain; charset=utf-8")
writer.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"")
http.ServeFile(writer, request, logPath)

Remediation: before serving, canonicalize the path
(filepath.Clean, resolving against the configured data directory)
and verify containment — the resolved path must be inside the deploy
log directory (e.g. filepath.Rel result must not start with ..).
Return 404 on violation. Do not use //nolint.

Definition of done:

make lint (golangci-lint ≥ 2.12) reports zero G703 findings
a unit test exercises the handler with a traversal-shaped input
(e.g. an id containing ..) and asserts it is rejected
legitimate log download still works (make test passes)
make fmt run before commit; TODO.md updated per the repo workflow
lands via PR from a feature branch off main

Surveyed 2026-08-07: golangci-lint 2.12.2 reports one `G703: Path traversal via taint analysis` finding at `internal/handlers/app.go:629` — `http.ServeFile` called with a `logPath` derived from request data: ```go filename := filepath.Base(logPath) writer.Header().Set("Content-Type", "text/plain; charset=utf-8") writer.Header().Set("Content-Disposition", "attachment; filename=\""+filename+"\"") http.ServeFile(writer, request, logPath) ``` Remediation: before serving, canonicalize the path (`filepath.Clean`, resolving against the configured data directory) and verify containment — the resolved path must be inside the deploy log directory (e.g. `filepath.Rel` result must not start with `..`). Return 404 on violation. Do not use `//nolint`. Definition of done: - `make lint` (golangci-lint ≥ 2.12) reports zero `G703` findings - a unit test exercises the handler with a traversal-shaped input (e.g. an id containing `..`) and asserts it is rejected - legitimate log download still works (`make test` passes) - `make fmt` run before commit; `TODO.md` updated per the repo workflow - lands via PR from a feature branch off `main`

clawbot added this to the 1.1.0 milestone 2026-08-07 18:40:39 +02:00

clawbot referenced this issue

2026-08-07 18:40:59 +02:00

Bump Dockerfile lint stage golangci-lint pin from v2.10.1 to current v2.12.x #179

clawbot referenced this issue

2026-08-07 18:41:25 +02:00

Tag and publish release 1.1.0 #182

clawbot referenced this issue

2026-08-07 18:47:29 +02:00

fix: resolve all 47 noctx lint findings in tests (closes #175) #183

clawbot referenced this issue

2026-08-07 18:53:00 +02:00