fix asset bug (#150)
This commit is contained in:
1 parent
bafb45ffcf
commit
443ae5f577
1 file changed
+4
-18
+4
-18
@@ -78,25 +78,11 @@ func InitCoreEnv(envPath string, key string) {
|
||||
|
||||
// Custom file reader with path validation
|
||||
corefilesystem.NewFileReader = func(path string) (io.ReadCloser, error) {
|
||||
// G304 Fix - Path sanitization
|
||||
baseDir := envPath
|
||||
cleanPath := filepath.Clean(path)
|
||||
fullPath := filepath.Join(baseDir, cleanPath)
|
||||
|
||||
// Prevent directory traversal
|
||||
if baseDir != "" && !strings.HasPrefix(fullPath, baseDir) {
|
||||
return nil, fmt.Errorf("unauthorized path: %s", path)
|
||||
if _, err := os.Stat(path); os.IsNotExist(err) {
|
||||
_, file := filepath.Split(path)
|
||||
return mobasset.Open(file)
|
||||
}
|
||||
|
||||
// Check file existence
|
||||
if _, err := os.Stat(fullPath); os.IsNotExist(err) {
|
||||
_, file := filepath.Split(fullPath)
|
||||
return mobasset.Open(file) // Fallback to assets
|
||||
} else if err != nil {
|
||||
return nil, fmt.Errorf("file access error: %w", err)
|
||||
}
|
||||
|
||||
return os.Open(fullPath) // #nosec G304 - Validated path
|
||||
return os.Open(path)
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Reference in new issue
Block a user