Validate and sanitize all config-sourced paths #2

New issue

Closed

opened 2026-02-02 10:00:56 +01:00 by qwc · 0 comments

qwc commented

2026-02-02 10:00:56 +01:00

Owner

Phase 1: Security Hardening

Device UUID, device Name, SourcePath, TargetPath, ScriptPath are used in exec.Command and path.Join without sanitization.

Tasks

Apply filepath.Clean + filepath.Abs, reject path traversal (..), reject symlinks for script paths
Validate script files exist, are regular files, and have safe permissions before execution

Files

backup.go
device.go
config.go

## Phase 1: Security Hardening Device UUID, device Name, SourcePath, TargetPath, ScriptPath are used in `exec.Command` and `path.Join` without sanitization. ### Tasks - Apply `filepath.Clean` + `filepath.Abs`, reject path traversal (`..`), reject symlinks for script paths - Validate script files exist, are regular files, and have safe permissions before execution ### Files - `backup.go` - `device.go` - `config.go`