fix(security): reject absolute file paths in SOPS provider to prevent arbitrary file access

1 file · +5 -1

M internal/adapters/out/secrets/sops.go +5 -1


@@ -88,11 +88,15 @@ func (s *SopsProvider) GetSecret(ctx context.Context, path string) (string, erro
88	88		filePath := parts[0]
89	89		keyPath := parts[1]
90	90
91		-	// Validate file path to prevent command injection
	91	+	// Validate file path to prevent command injection and path traversal
92	92		cleanPath := filepath.Clean(filePath)
93	93		if strings.Contains(cleanPath, "..") {
94	94		return "", fmt.Errorf("invalid file path: path traversal not allowed")
95	95		}
	96	+	// SECURITY: Reject absolute paths to prevent reading arbitrary files on the system.
	97	+	if filepath.IsAbs(cleanPath) {
	98	+	return "", fmt.Errorf("invalid file path: absolute paths not allowed")
	99	+	}
96	100
97	101		// Validate key path to prevent command injection
98	102		if !sopsKeyPathRegex.MatchString(keyPath) {

 	filePath := parts[0]
 	keyPath := parts[1]
-	// Validate file path to prevent command injection
+	// Validate file path to prevent command injection and path traversal
 	cleanPath := filepath.Clean(filePath)
 	if strings.Contains(cleanPath, "..") {
 		return "", fmt.Errorf("invalid file path: path traversal not allowed")
 	}
+	// SECURITY: Reject absolute paths to prevent reading arbitrary files on the system.
+	if filepath.IsAbs(cleanPath) {
+		return "", fmt.Errorf("invalid file path: absolute paths not allowed")
+	}
 	// Validate key path to prevent command injection
 	if !sopsKeyPathRegex.MatchString(keyPath) {