InterDiode/id_configurator
1
0
Fork 0
mirror of https://github.com/d9pouces/id_configurator.git synced 2026-11-09 01:47:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: sanitize filenames in apt and yum modules to prevent path traversal

Browse Source 
Signed-off-by: d9pouces <github@19pouces.net>
This commit is contained in:
d9pouces
2026-09-09 23:18:24 +02:00
parent 4409c38579
commit be91425355
10 changed files with 169 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
id_configurator/modules/apt.py
+3 -3
View File
@@ -29,7 +29,7 @@ from pathlib import Path
from id_configurator.config import AptSource
from id_configurator.context import Context
from id_configurator.modules.base import Module, register
from id_configurator.modules.base import Module, register, sanitize_filename
logger = logging.getLogger(__name__)
@@ -122,7 +122,7 @@ class AptModule(Module):
def _resolve_signed_by(self, context: Context, source: AptSource) -> str | None:
if source.signed_by:
keyring = _dearmor_gpg_key(source.name, source.signed_by.encode("utf-8"))
relative = f"{_KEYRINGS_DIR}/{source.name}.gpg"
relative = f"{_KEYRINGS_DIR}/{sanitize_filename(source.name)}.gpg"
context.write_file(relative, keyring)
logger.info("installed apt keyring for source %s", source.name)
return f"/{relative}"
@@ -134,7 +134,7 @@ class AptModule(Module):
for source in context.config.configurations.apt.sources:
signed_by_path = self._resolve_signed_by(context, source)
context.write_file(
f"{_SOURCES_LIST_D}/{source.name}.sources",
f"{_SOURCES_LIST_D}/{sanitize_filename(source.name)}.sources",
source.to_deb822(signed_by_path).encode("utf-8"),
)
logger.info("added apt source %s", source.name)