[Feature/simultaneous_queues] Improved version for scenario management #29
Conversation
…lt scenario configuration
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| scenario_commands_file = os.path.join( | ||
| nebula_config_dir, scenario_name, "current_scenario_commands.sh" | ||
| ) | ||
| if os.path.exists(scenario_commands_file): |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the problem, we need to validate the scenario_name before using it to construct file paths. We can use the os.path.normpath function to normalize the path and ensure it is contained within a safe root directory. Additionally, we can use a whitelist of allowed characters to further sanitize the scenario_name.
- Normalize the
scenario_nameusingos.path.normpath. - Ensure the normalized path starts with the expected base directory.
- Optionally, sanitize the
scenario_nameto allow only specific characters.
| @@ -397,2 +397,6 @@ | ||
| if scenario_name: | ||
| # Normalize and validate scenario_name | ||
| scenario_name = os.path.normpath(scenario_name) | ||
| if not scenario_name.startswith(nebula_config_dir): | ||
| raise Exception("Invalid scenario name") | ||
| if os.environ.get("NEBULA_HOST_PLATFORM") == "windows": |
| nebula_config_dir, scenario_name, "current_scenario_commands.sh" | ||
| ) | ||
| if os.path.exists(scenario_commands_file): | ||
| os.remove(scenario_commands_file) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 3 months ago
To fix the problem, we need to validate the scenario_name before using it to construct file paths. We can use the os.path.normpath function to normalize the path and ensure it is contained within a safe root directory. Additionally, we can use a whitelist of allowed characters to further sanitize the scenario_name.
- Normalize the
scenario_nameusingos.path.normpath. - Ensure the normalized path starts with the expected base directory.
- Use a whitelist of allowed characters to sanitize the
scenario_name.
| @@ -397,2 +397,6 @@ | ||
| if scenario_name: | ||
| # Normalize and validate scenario_name | ||
| scenario_name = os.path.normpath(scenario_name) | ||
| if not scenario_name.isalnum(): | ||
| raise ValueError("Invalid scenario name") | ||
| if os.environ.get("NEBULA_HOST_PLATFORM") == "windows": |
No description provided.