Skip to content

fix: Reject symbolic links as scan target or project root #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
danskmt wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

fix: Reject symbolic links as scan target or project root #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ require (
github.com/puzpuzpuz/xsync v1.5.2
github.com/rs/zerolog v1.34.0
github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6
github.com/snyk/go-application-framework v0.16.1
github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509
github.com/spf13/pflag v1.0.6
github.com/stretchr/testify v1.11.1
golang.org/x/net v0.57.0
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,8 +246,8 @@ github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnB
github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6 h1:XUPFP85nBh+zDCTvxxBuouZP9yG7H1qXZiMGFVMWVKM=
github.com/snyk/error-catalog-golang-public v0.0.0-20260806122555-28dc45bbbde6/go.mod h1:0dz+HUR/r7VLlQpLfF0a/F1tdHH84NLTZzCxjZ+Q1nk=
github.com/snyk/go-application-framework v0.16.1 h1:k4eyP4EX/kqnNyu5uuFLEw4wflTom22ea23ZuG74JU8=
github.com/snyk/go-application-framework v0.16.1/go.mod h1:qJBU+FIY8s/lIg0IaKBj7WGeGERiWqyJvhajzxiA3Ls=
github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509 h1:u0rM+W6It0MmwnxmUsujp/D0HPDubEcurBidbuKVJr4=
github.com/snyk/go-application-framework v0.18.2-0.20260825125146-df40372f0509/go.mod h1:UJMR1Tk4OPGFa03O9cko4ic0GeaqmSO03fx55HpOFp0=
github.com/snyk/go-httpauth v0.0.0-20260810142636-0f6182aaccbc h1:tuZVhmJFxS4qJlwYIIIw8xgw3VaVqIR3IAV0WaaFVnI=
github.com/snyk/go-httpauth v0.0.0-20260810142636-0f6182aaccbc/go.mod h1:f42qLL7WXOS0od7dXJV/hK3myjms/r6HsXgLrg1HRRY=
github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
Expand Down
13 changes: 10 additions & 3 deletions internal/commands/code_workflow/native_workflow.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@ import (
"context"
"encoding/json"
"errors"
"fmt"
"os"
"path"
"path/filepath"
Expand Down Expand Up @@ -358,11 +359,17 @@ func determineAnalyzeInput(invocationCtx workflow.InvocationContext, path string

var files <-chan string

pathIsDirectory := false
if fileinfo, fileInfoErr := os.Stat(path); fileInfoErr == nil && fileinfo.IsDir() {
pathIsDirectory = true
linfo, err := os.Lstat(path)
if err != nil {
return nil, nil, fmt.Errorf("cannot access path %q: %w", path, err)
}

if linfo.Mode()&os.ModeSymlink != 0 {
return nil, nil, fmt.Errorf("path %q is a symbolic link; pass the real path instead", path)
}

pathIsDirectory := linfo.IsDir()

if !pathIsDirectory {
target, err := scan.NewRepositoryTarget(filepath.Dir(path), scan.WithRepositoryUrl(config.GetString(configuration.FLAG_REMOTE_REPO_URL)), scan.WithCommitId(config.GetString(ConfigurationCommitId)))
if err != nil {
Expand Down
23 changes: 23 additions & 0 deletions internal/commands/code_workflow/native_workflow_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -464,6 +464,29 @@ func Test_determineAnalyzeInput(t *testing.T) {

assert.Equal(t, 1, count)
})

t.Run("rejects a symlink to a file", func(t *testing.T) {
ictx := testInvocationContext(t, config, &logger, nil, nil, analytics.New())

link := filepath.Join(path, "link.txt")
require.NoError(t, os.Symlink(filenames[0], link))
t.Cleanup(func() { os.Remove(link) })

_, _, err := determineAnalyzeInput(ictx, link)
assert.Error(t, err)
assert.Contains(t, err.Error(), "symbolic link")
})

t.Run("rejects a symlink to a directory", func(t *testing.T) {
ictx := testInvocationContext(t, config, &logger, nil, nil, analytics.New())

linkDir := filepath.Join(t.TempDir(), "linked-repo")
require.NoError(t, os.Symlink(path, linkDir))

_, _, err := determineAnalyzeInput(ictx, linkDir)
assert.Error(t, err)
assert.Contains(t, err.Error(), "symbolic link")
})
}

func Test_TrackUsage(t *testing.T) {
Expand Down
Loading