From d1ece5756cf3026db6e0c5e62e12a87c81507ccd Mon Sep 17 00:00:00 2001 From: Alex Wichmann Date: Wed, 15 Jul 2026 20:59:55 +0200 Subject: [PATCH] Potential fix for code scanning alert no. 8: Uncontrolled data used in path expression Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --- internal/storage/filesystem.go | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/internal/storage/filesystem.go b/internal/storage/filesystem.go index 8f54a99..4dc4d55 100644 --- a/internal/storage/filesystem.go +++ b/internal/storage/filesystem.go @@ -512,7 +512,11 @@ func (fs Filesystem) manifestDigestPath(repoPath, digest string) (string, error) } func (fs Filesystem) linkManifestTag(repoPath, tag, digest string) error { - tagPath := fs.safeJoin("repositories", repoPath, "tags", sanitizeReference(tag)) + safeTag, err := sanitizeReference(tag) + if err != nil { + return err + } + tagPath := fs.safeJoin("repositories", repoPath, "tags", safeTag) if err := os.MkdirAll(filepath.Dir(tagPath), 0o750); err != nil { return err } @@ -668,8 +672,22 @@ func safeRepositoryPath(repository string) (string, error) { return repository, nil } -func sanitizeReference(reference string) string { - reference = strings.ReplaceAll(reference, "/", "_") - reference = strings.ReplaceAll(reference, ":", "_") - return reference +func sanitizeReference(reference string) (string, error) { + reference = strings.TrimSpace(reference) + if reference == "" { + return "", fmt.Errorf("invalid reference") + } + if strings.Contains(reference, "/") || strings.Contains(reference, "\\") || strings.Contains(reference, "..") { + return "", fmt.Errorf("invalid reference") + } + for _, r := range reference { + if (r >= 'a' && r <= 'z') || + (r >= 'A' && r <= 'Z') || + (r >= '0' && r <= '9') || + r == '.' || r == '-' || r == '_' { + continue + } + return "", fmt.Errorf("invalid reference") + } + return reference, nil }