google-labs-jules[bot]
1018ea17d9
🚨 Severity: CRITICAL 💡 Vulnerability: The generic file hashing utility `app/utils/file_operations.py:hash_file` was vulnerable to path traversal. An attacker controlling the `filepath` argument could read arbitrary files on the system by passing relative paths like `../../../etc/passwd` or providing absolute paths directly. 🎯 Impact: This could lead to Arbitrary File Read and potential information disclosure. 🔧 Fix: Used `pathlib.Path.resolve()` to resolve both the target file path and the allowed base directory (`settings.workdir`). Added a strict check to ensure the resolved target path is strictly within the allowed boundary using `filepath_obj.relative_to(workdir_obj)`, catching the `ValueError` raised when the path is out of bounds. This safely blocks both relative traversal attacks and arbitrary absolute paths, without breaking legitimate relative application paths. ✅ Verification: Ran the test suite `pytest tests/test_path_traversal_security.py -v` successfully, which explicitly checks for `FileNotFoundError` upon traversal attempts. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
29 lines
893 B
Python
29 lines
893 B
Python
import hashlib
|
|
from pathlib import Path
|
|
|
|
|
|
def hash_file(filepath: str | Path, chunk_size: int = 65536) -> str:
|
|
"""
|
|
Returns the SHA-256 hash of the file at 'filepath'.
|
|
Reads the file in chunks to handle large files efficiently.
|
|
"""
|
|
from app.config import settings
|
|
|
|
filepath_obj = Path(filepath).resolve()
|
|
workdir_obj = Path(settings.workdir).resolve()
|
|
|
|
# Security check: Ensure the resolved path is strictly within the allowed workdir
|
|
try:
|
|
filepath_obj.relative_to(workdir_obj)
|
|
except ValueError:
|
|
raise FileNotFoundError(f"Access denied: path traversal attempt or file outside workdir '{filepath}'")
|
|
|
|
sha256 = hashlib.sha256()
|
|
with open(filepath_obj, "rb") as f:
|
|
while True:
|
|
data = f.read(chunk_size)
|
|
if not data:
|
|
break
|
|
sha256.update(data)
|
|
return sha256.hexdigest()
|