fix: add CodeQL-recognized path sanitization for domain_name

2026-08-07 13:33:55 -05:00
parent 1dbbd6a943
commit 5130076400
1 changed files with 10 additions and 0 deletions
@@ -4529,6 +4529,16 @@ async def api_domains_set(req: DomainSetRequest):
    _ensure_domains_dir()
    domain_path = os.path.join(DOMAINS_DIR, req.domain_name)
    # --- CodeQL path-injection fix ---
    # _validate_safe_name already enforces ^[a-zA-Z0-9_-]+$, but CodeQL
    # does not recognize it as a sanitizer. Add explicit checks that
    # CodeQL *does* recognize: basename equality and commonpath containment.
    if os.path.basename(domain_path) != req.domain_name:
        raise HTTPException(status_code=400, detail="Invalid domain_name")
    # Ensure the final path is still inside DOMAINS_DIR (prevents ../ traversal)
    # Use normpath + commonpath — recognized by py/path-injection query.
    if os.path.commonpath([os.path.normpath(DOMAINS_DIR), os.path.normpath(domain_path)]) != os.path.normpath(DOMAINS_DIR):
        raise HTTPException(status_code=400, detail="Invalid domain_name")
    with open(domain_path, "w") as f:
        f.write(normalized)
    _chown_to_caddy(domain_path)