Dependabot suggested updates #24
Conversation
remaned ta10 to tarzan
updated tarzan documentation
Fix tpm typo in intents.md
…base64 throughout
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| dbcursorerror := datalayer.DB.Collection("expectedvalues").FindOne(context.TODO(), filter).Decode(&elem) | ||
|
|
||
| //dbcursorerror := datalayer.DB.Collection("expectedvalues").FindOne(context.TODO(), filter).Decode(&elem) | ||
| datalayer.DB.Collection("expectedvalues").FindOne(context.TODO(), filter).Decode(&elem) |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
Copilot Autofix
AI 9 days ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
| _, dberr := datalayer.DB.Collection("opaqueobjects").UpdateOne(context.TODO(), filter, h, options) | ||
| update := bson.D{{"$set", h}} | ||
|
|
||
| _, dberr := datalayer.DB.Collection("opaqueobjects").UpdateOne(context.TODO(), filter, update, options) |
Check failure
Code scanning / CodeQL
Database query built from user-controlled sources High
Copilot Autofix
AI 9 days ago
Copilot could not generate an autofix suggestion
Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.
|
|
||
| u := GetEventLogLocation(fmt.Sprintf("%v", postbody["uefi/eventlog"])) | ||
|
|
||
| fcontent, err := ioutil.ReadFile(u) |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 9 days ago
In general, the fix is to ensure that any file path ultimately passed to ioutil.ReadFile is either (a) a constant or from an allow list, or (b) validated so it cannot escape a trusted directory or become an arbitrary absolute path. Here, we only see this endpoint reading the UEFI event log, which should come from a known location. The simplest, least invasive fix is to stop honoring the user‑provided path altogether and always use UEFIEVENTLOGLOCATION, even when utilities.IsUnsafe() is true.
The single best fix without changing visible functionality (other than removing the dangerous behavior) is to change GetEventLogLocation so it no longer returns the caller‑supplied loc when unsafe mode is enabled. Instead, it should always return UEFIEVENTLOGLOCATION. We can keep the debug printing to avoid disrupting logging. This change is localized to GetEventLogLocation in tarzan/uefi/endpoints.go; Eventlog can remain unchanged, though its argument to GetEventLogLocation will become effectively ignored. No new imports or helper methods are needed.
Concretely:
- In
tarzan/uefi/endpoints.go, lines 32–38 insideGetEventLogLocationshould be replaced so that both branches returnUEFIEVENTLOGLOCATION. We can preserve theIsUnsafe()information only for logging if desired, but the path returned must no longer depend onloc.
| @@ -29,13 +29,10 @@ | ||
| func GetEventLogLocation(loc string) string { | ||
| fmt.Printf("UEFI Log requested from %v, unsafe mode is %v, giving: ", loc, utilities.IsUnsafe()) | ||
|
|
||
| if utilities.IsUnsafe() == true { | ||
| fmt.Printf("%v\n", loc) | ||
| return loc | ||
| } else { | ||
| fmt.Printf("%v\n", UEFIEVENTLOGLOCATION) | ||
| return UEFIEVENTLOGLOCATION | ||
| } | ||
| // Always return the fixed, trusted event log location to avoid using | ||
| // user-controlled paths, even when running in unsafe mode. | ||
| fmt.Printf("%v\n", UEFIEVENTLOGLOCATION) | ||
| return UEFIEVENTLOGLOCATION | ||
| } | ||
|
|
||
| func Eventlog(c echo.Context) error { |
No description provided.