Skip to content

Fix path traversal vulnerability detection on close#3172

Merged
uurien merged 1 commit into
masterfrom
ugaitz/improve-path-traversal-detection
May 19, 2023
Merged

Fix path traversal vulnerability detection on close#3172
uurien merged 1 commit into
masterfrom
ugaitz/improve-path-traversal-detection

Conversation

@uurien

@uurien uurien commented May 18, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

We have detected that an extra vulnerability was reported on dir.close function when the open was already vulnerable point. This PR prevents this double detection.

Plugin Checklist

  • Unit tests.

@github-actions

github-actions Bot commented May 18, 2023 •
edited
Loading

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 4.13 MB
Deduped: 58.26 MB
No deduping: 58.31 MB

Dependency sizes

name version self size total size
@datadog/pprof 2.2.1 14.24 MB 15.12 MB
@datadog/native-iast-taint-tracking 1.4.1 14.85 MB 14.86 MB
@datadog/native-appsec 3.1.0 13.31 MB 13.32 MB
protobufjs 7.1.2 2.76 MB 6.55 MB
@datadog/native-iast-rewriter 2.0.1 2.09 MB 2.1 MB
@datadog/native-metrics 2.0.0 898.77 kB 1.3 MB
opentracing 0.14.7 194.81 kB 194.81 kB
semver 7.3.8 88.2 kB 118.6 kB
@datadog/sketches-js 2.1.0 109.9 kB 109.9 kB
lodash.sortby 4.7.0 75.76 kB 75.76 kB
lru-cache 7.14.0 74.95 kB 74.95 kB
ipaddr.js 2.0.1 59.52 kB 59.52 kB
ignore 5.2.0 48.87 kB 48.87 kB
import-in-the-middle 1.3.5 34.34 kB 38.81 kB
istanbul-lib-coverage 3.2.0 29.34 kB 29.34 kB
retry 0.10.1 27.44 kB 27.44 kB
lodash.uniq 4.5.0 25.01 kB 25.01 kB
limiter 1.1.5 23.17 kB 23.17 kB
lodash.kebabcase 4.1.1 17.75 kB 17.75 kB
lodash.pick 4.4.0 16.33 kB 16.33 kB
node-abort-controller 3.0.1 14.33 kB 14.33 kB
crypto-randomuuid 1.0.0 11.18 kB 11.18 kB
diagnostics_channel 1.1.0 7.07 kB 7.07 kB
path-to-regexp 0.1.7 6.78 kB 6.78 kB
koalas 1.0.2 6.47 kB 6.47 kB
methods 1.1.2 5.29 kB 5.29 kB
module-details-from-path 1.0.3 4.47 kB 4.47 kB

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@uurien
uurien force-pushed the ugaitz/improve-path-traversal-detection branch from 3154e12 to 266ed34 Compare May 18, 2023 15:22
@codecov

codecov Bot commented May 18, 2023 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

Merging #3172 (8627c97) into master (3428a1f) will increase coverage by 0.02%.
The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master    #3172      +/-   ##
==========================================
+ Coverage   86.95%   86.97%   +0.02%     
==========================================
  Files         322      322              
  Lines       11763    11765       +2     
  Branches       33       33              
==========================================
+ Hits        10228    10233       +5     
+ Misses       1535     1532       -3
Impacted Files Coverage Δ
...c/appsec/iast/analyzers/path-traversal-analyzer.js 100.00% <100.00%> (ø)

... and 2 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@uurien
uurien marked this pull request as ready for review May 18, 2023 15:27
@uurien
uurien requested a review from a team as a code owner May 18, 2023 15:27
@uurien
uurien force-pushed the ugaitz/improve-path-traversal-detection branch from 266ed34 to 8627c97 Compare May 18, 2023 15:35
@uurien uurien changed the title Fix path traversal vulnerability on dir.close Fix path traversal vulnerability on close May 18, 2023
@pr-commenter

pr-commenter Bot commented May 18, 2023

Copy link
Copy Markdown

Benchmarks

Comparing candidate commit 8627c97 in PR branch ugaitz/improve-path-traversal-detection with baseline commit 3428a1f in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 445 metrics, 27 unstable metrics.

@uurien
uurien merged commit 7646468 into master May 19, 2023
@uurien uurien changed the title Fix path traversal vulnerability on close Fix path traversal vulnerability detection on close May 19, 2023
thedavl pushed a commit that referenced this pull request May 30, 2023
@thedavl
Fix path traversal vulnerability detection on close (#3172)
51f2655
uurien pushed a commit that referenced this pull request Jun 1, 2023
Fix path traversal vulnerability detection on close (#3172)
85c4227
uurien pushed a commit that referenced this pull request Jun 1, 2023
Fix path traversal vulnerability detection on close (#3172)
a347a68
uurien pushed a commit that referenced this pull request Jun 1, 2023
Fix path traversal vulnerability detection on close (#3172)
65e7985
This was referenced Jun 1, 2023
Merged
Merged
Merged
uurien pushed a commit that referenced this pull request Jun 2, 2023
@uurien
Fix path traversal vulnerability detection on close (#3172)
7420171
uurien pushed a commit that referenced this pull request Jun 2, 2023
@uurien
Fix path traversal vulnerability detection on close (#3172)
b09c1e1
uurien pushed a commit that referenced this pull request Jun 2, 2023
@uurien
Fix path traversal vulnerability detection on close (#3172)
b6d8ec7
@tlhunter
tlhunter deleted the ugaitz/improve-path-traversal-detection branch January 19, 2024 22:24
@erikvanbrakel erikvanbrakel mentioned this pull request Jul 5, 2024
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@tlhunter tlhunter tlhunter approved these changes
@CarlesDD CarlesDD CarlesDD approved these changes
+1 more reviewer
@Qard Qard Qard approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

asm-iast semver-patch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@uurien @Qard @tlhunter @CarlesDD