Skip to content

Conversation

@sean-breen
Copy link
Contributor

@sean-breen sean-breen commented Sep 16, 2025

Proposed changes

Stops isAllowedDir function from matching by prefix. Originally this function would allow any path which was prefixed by an allowed directory, i.e

  • if /var/log/nginx was present in allowed dirs, then the path /var/log/nginx-test would also be allowed. Not good!

This PR stops this match from taking place, but still matches if the provided path is a subdirectory of an already allowed directory, i.e

  • if /var/log/nginx is in allowed dirs, /var/log/nginx/mysubdir will be allowed but /var/log/nginx-test will be blocked.

Checklist

Before creating a PR, run through this checklist and mark each as complete.

  • I have read the CONTRIBUTING document
  • I have run make install-tools and have attached any dependency changes to this pull request
  • If applicable, I have added tests that prove my fix is effective or that my feature works
  • If applicable, I have checked that any relevant tests pass after adding my changes
  • If applicable, I have updated any relevant documentation (README.md)
  • If applicable, I have tested my cross-platform changes on Ubuntu 22, Redhat 8, SUSE 15 and FreeBSD 13

@sean-breen sean-breen requested a review from a team as a code owner September 16, 2025 11:05
@github-actions github-actions bot added bug Something isn't working chore Pull requests for routine tasks labels Sep 16, 2025
@sean-breen sean-breen marked this pull request as draft September 18, 2025 08:44
@sean-breen sean-breen marked this pull request as ready for review September 24, 2025 15:41
@sean-breen sean-breen merged commit c904afa into main Sep 30, 2025
65 of 66 checks passed
@sean-breen sean-breen deleted the allowedDirs_byPrefix branch September 30, 2025 14:42
@sean-breen sean-breen restored the allowedDirs_byPrefix branch September 30, 2025 14:43
@sean-breen sean-breen deleted the allowedDirs_byPrefix branch October 2, 2025 09:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working chore Pull requests for routine tasks

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants