Merge pull request #2 from armanfeyzi/af/add-gosec-sast

Add gosec SAST to CI and harden credentials file loading.

Author: armanfeyzi

.github/workflows/ci.yml

@@ -39,6 +39,11 @@ jobs:
         with:
           version: v2.12
 
+      - name: SAST (gosec)
+        uses: securego/gosec@master
+        with:
+          args: -severity high -confidence high ./...
+
       - name: Build Linux amd64 binary
         run: |
           mkdir -p dist

internal/config/config.go

@@ -1,8 +1,10 @@
 package config
 
 import (
+	"errors"
 	"log/slog"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -132,10 +134,41 @@ func getEnvFloat32(key string, fallback float32) float32 {
 	return float32(f)
 }
 
+func validateCredentialsFilePath(path string) (string, error) {
+	path = strings.TrimSpace(path)
+	if path == "" {
+		return "", errors.New("empty credentials file path")
+	}
+	if strings.Contains(path, "..") {
+		return "", errors.New("credentials file path must not contain parent segments")
+	}
+	clean := filepath.Clean(path)
+	if !filepath.IsAbs(clean) {
+		return "", errors.New("credentials file path must be absolute")
+	}
+	return clean, nil
+}
+
 func loadRegistryCredentialsFromEnv() map[string]registryauth.Credential {
-	filePath := strings.TrimSpace(os.Getenv("HELM_WATCH_REGISTRY_CREDENTIALS_FILE"))
-	if filePath != "" {
-		data, err := os.ReadFile(filePath)
+	rawPath := strings.TrimSpace(os.Getenv("HELM_WATCH_REGISTRY_CREDENTIALS_FILE"))
+	if rawPath != "" {
+		filePath, err := validateCredentialsFilePath(rawPath)
+		if err != nil {
+			slog.Warn("registry credentials file path invalid", "path", rawPath, "error", err)
+			return nil
+		}
+		dir, name := filepath.Split(filePath)
+		if name == "" || name == "." || name == ".." {
+			slog.Warn("registry credentials file path invalid", "path", filePath, "error", "invalid file name")
+			return nil
+		}
+		root, err := os.OpenRoot(dir)
+		if err != nil {
+			slog.Warn("registry credentials file not loaded", "path", filePath, "error", err)
+			return nil
+		}
+		defer func() { _ = root.Close() }()
+		data, err := root.ReadFile(name)
 		if err != nil {
 			slog.Warn("registry credentials file not loaded", "path", filePath, "error", err)
 			return nil

internal/config/config_test.go

@@ -0,0 +1,39 @@
+package config
+
+import "testing"
+
+func TestValidateCredentialsFilePath(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		path    string
+		want    string
+		wantErr bool
+	}{
+		{name: "absolute ok", path: "/var/run/secrets/creds.json", want: "/var/run/secrets/creds.json"},
+		{name: "empty", path: "", wantErr: true},
+		{name: "relative", path: "creds.json", wantErr: true},
+		{name: "parent segment", path: "/var/run/../etc/passwd", wantErr: true},
+		{name: "whitespace trimmed", path: "  /etc/creds.json  ", want: "/etc/creds.json"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			got, err := validateCredentialsFilePath(tt.path)
+			if tt.wantErr {
+				if err == nil {
+					t.Fatalf("validateCredentialsFilePath(%q) = %q, want error", tt.path, got)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("validateCredentialsFilePath(%q): %v", tt.path, err)
+			}
+			if got != tt.want {
+				t.Fatalf("validateCredentialsFilePath(%q) = %q, want %q", tt.path, got, tt.want)
+			}
+		})
+	}
+}