You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/19 06:05:49 UTC

[I] Path traversal in attestable file path construction (tooling-trusted-releases)

andrewmusselman opened a new issue, #719:
URL: https://github.com/apache/tooling-trusted-releases/issues/719

   **ASVS Requirement:** 5.3.2 — Verify that user-submitted filenames/paths are protected against path traversal, LFI, RFI, and SSRF.
   
   **Description:**
   
   Functions in `atr/attestable.py` (lines 37-48) construct file paths by directly joining user-controllable parameters (`project_name`, `version_name`, `revision_number`) without validation against path traversal sequences. These paths are used in file write operations (`.json` attestation files).
   
   **Affected functions:**
   - `attestable_path()`
   - `attestable_paths_path()`
   - `github_tp_payload_path()`
   
   **Attack vector:** A value like `../../etc` for any parameter could escape the intended `attestable/` directory structure during writes.
   
   **CWE:** CWE-22 (Path Traversal)
   
   **Recommended remediation:**
   Add a shared path component validator that rejects `..`, `/`, `\`, and `\x00` in all three parameters, and apply it in each function before constructing the path.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases)

Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #719:
URL: https://github.com/apache/tooling-trusted-releases/issues/719#issuecomment-3947603554

   In reviewing the code it is hard to tell if in every case the `project_name`, `version`, and `revision` is always validated first. If not then other "bad" things could happen before arriving in `atr/attestable.py`. The solution is to look at every place these values come in to assure that they are validated at the "front door".
   
   If we truly want to check here then errors should throw an error with a stack trace and be "fatal".


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #719:
URL: https://github.com/apache/tooling-trusted-releases/issues/719#issuecomment-4022423550

   The new datatypes validate project_name and version_name (and support release_name) as they come in from a URL. I haven't added revision but we could do so easily. Personally I'd say we can close this and open a new lower priority ticket for revision number (since I don't think we use it in those URLs very often?).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases)

Posted by "alitheg (via GitHub)" <gi...@apache.org>.
alitheg commented on issue #719:
URL: https://github.com/apache/tooling-trusted-releases/issues/719#issuecomment-3950813667

   I did some tracing through the calls for these methods and it looks like they're always validated by requesting a release or a revision from the database before they make it to these methods.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases)

Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #719: Path traversal in attestable file path construction
URL: https://github.com/apache/tooling-trusted-releases/issues/719


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org

Re: [I] Path traversal in attestable file path construction (tooling-trusted-releases)

Posted by "sbp (via GitHub)" <gi...@apache.org>.
sbp commented on issue #719:
URL: https://github.com/apache/tooling-trusted-releases/issues/719#issuecomment-3952959338

   Would be closed by #643.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org