|
 |
456ad1 |
commit ea77415cfe2cefe46ffce233076a1409abaa8df7
|
|
|
456ad1 |
Author: Will Browne <wbrowne@users.noreply.github.com>
|
|
|
456ad1 |
Date: Fri Dec 10 11:29:12 2021 +0000
|
|
|
456ad1 |
|
|
|
456ad1 |
apply fix (#42969)
|
|
|
456ad1 |
|
|
|
456ad1 |
diff --git a/pkg/plugins/plugins.go b/pkg/plugins/plugins.go
|
|
|
456ad1 |
index e6370a29e7..c7199c716e 100644
|
|
|
456ad1 |
--- a/pkg/plugins/plugins.go
|
|
|
456ad1 |
+++ b/pkg/plugins/plugins.go
|
|
|
456ad1 |
@@ -491,15 +491,15 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) {
|
|
|
456ad1 |
}
|
|
|
456ad1 |
|
|
|
456ad1 |
// nolint:gosec
|
|
|
456ad1 |
- // We can ignore the gosec G304 warning on this one because `plug.PluginDir` is based
|
|
|
456ad1 |
- // on plugin the folder structure on disk and not user input.
|
|
|
456ad1 |
- path := filepath.Join(plug.PluginDir, fmt.Sprintf("%s.md", strings.ToUpper(name)))
|
|
|
456ad1 |
+ // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently
|
|
|
456ad1 |
+ // use this with a prefix of the plugin's directory, which is set during plugin loading
|
|
|
456ad1 |
+ path := filepath.Join(plug.PluginDir, mdFilepath(strings.ToUpper(name)))
|
|
|
456ad1 |
exists, err := fs.Exists(path)
|
|
|
456ad1 |
if err != nil {
|
|
|
456ad1 |
return nil, err
|
|
|
456ad1 |
}
|
|
|
456ad1 |
if !exists {
|
|
|
456ad1 |
- path = filepath.Join(plug.PluginDir, fmt.Sprintf("%s.md", strings.ToLower(name)))
|
|
|
456ad1 |
+ path = filepath.Join(plug.PluginDir, mdFilepath(strings.ToLower(name)))
|
|
|
456ad1 |
}
|
|
|
456ad1 |
|
|
|
456ad1 |
exists, err = fs.Exists(path)
|
|
|
456ad1 |
@@ -511,8 +511,8 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) {
|
|
|
456ad1 |
}
|
|
|
456ad1 |
|
|
|
456ad1 |
// nolint:gosec
|
|
|
456ad1 |
- // We can ignore the gosec G304 warning on this one because `plug.PluginDir` is based
|
|
|
456ad1 |
- // on plugin the folder structure on disk and not user input.
|
|
|
456ad1 |
+ // We can ignore the gosec G304 warning since we have cleaned the requested file path and subsequently
|
|
|
456ad1 |
+ // use this with a prefix of the plugin's directory, which is set during plugin loading
|
|
|
456ad1 |
data, err := ioutil.ReadFile(path)
|
|
|
456ad1 |
if err != nil {
|
|
|
456ad1 |
return nil, err
|
|
|
456ad1 |
@@ -520,6 +520,10 @@ func GetPluginMarkdown(pluginId string, name string) ([]byte, error) {
|
|
|
456ad1 |
return data, nil
|
|
|
456ad1 |
}
|
|
|
456ad1 |
|
|
|
456ad1 |
+func mdFilepath(mdFilename string) string {
|
|
|
456ad1 |
+ return filepath.Clean(filepath.Join("/", fmt.Sprintf("%s.md", mdFilename)))
|
|
|
456ad1 |
+}
|
|
|
456ad1 |
+
|
|
|
456ad1 |
// gets plugin filenames that require verification for plugin signing
|
|
|
456ad1 |
func collectPluginFilesWithin(rootDir string) ([]string, error) {
|
|
|
456ad1 |
var files []string
|