llvy.ltd/casdoor
1
0
Fork 0
mirror of https://github.com/casdoor/casdoor.git synced 2025-07-01 10:00:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: Gosec/sec fixes (#2004)

Browse Source 
* Customization of the initialization file

* fix: G601 (CWE-118): Implicit memory aliasing in for loop

* fix: G304 (CWE-22): Potential file inclusion via variable

* fix: G110 (CWE-409): Potential DoS vulnerability via decompression bomb
This commit is contained in:
Alex OvsInc
2023-06-21 13:55:20 +03:00
committed by GitHub
parent d505a4bf2d
commit 6ebca6dbe7
11 changed files with 25 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
util/string.go
View File

@ -22,6 +22,7 @@ import (
"fmt"
"math/rand"
"os"
"path/filepath"
"strconv"
"strings"
"time"
@ -201,7 +202,7 @@ func GetMinLenStr(strs ...string) string {
}
func ReadStringFromPath(path string) string {
data, err := os.ReadFile(path)
data, err := os.ReadFile(filepath.Clean(path))
if err != nil {
panic(err)
}

3
util/system.go
View File

@ -18,6 +18,7 @@ import (
"bufio"
"os"
"path"
"path/filepath"
"regexp"
"runtime"
"strconv"
@ -155,7 +156,7 @@ func GetVersionInfoFromFile() (*VersionInfo, error) {
_, filename, _, _ := runtime.Caller(0)
rootPath := path.Dir(path.Dir(filename))
file, err := os.Open(path.Join(rootPath, "version_info.txt"))
file, err := os.Open(filepath.Clean(path.Join(rootPath, "version_info.txt")))
if err != nil {
return res, err
}