blacktop c20f9af712 fix: multiple security vulnerabilities (SSRF, path traversal) ...

- Remove POST /diff/files endpoint that allowed arbitrary host file reads
  (CWE-22); clients must now read files locally and POST content to
  /diff/blobs instead
- Add validatePublicURL() to /info remote endpoints, rejecting URLs that
  resolve to loopback, private, link-local, or multicast addresses to
  prevent SSRF; also remove attacker-controlled proxy/insecure params
- Add SanitizeArchivePath() helper that verifies extracted archive entry
  paths stay within the destination directory (zip-slip / tar-slip,
  CWE-22); replace bare filepath.Join(dest, filepath.Clean(name)) calls
  in SearchZip, OTA parser, AA payload extractor, and ota_extract
- Fix server listen address to use net.JoinHostPort to respect Host config

2026-04-11 14:37:41 -06:00

143 KiB

Raw Permalink Blame History