Skip to content

Update read_log to handle any log name#480

Open
DavidCockerill wants to merge 3 commits intomainfrom
name-read-log
Open

Update read_log to handle any log name#480
DavidCockerill wants to merge 3 commits intomainfrom
name-read-log

Conversation

@DavidCockerill
Copy link
Copy Markdown
Member

No description provided.

@claude
Copy link
Copy Markdown
Contributor

claude Bot commented May 6, 2026

1. Traversal guard uses && where || is needed — Windows backslash test will fail

File: validation/readLogValidator.js:45

What: && only blocks when both POSIX and Win32 agree the value is not a plain basename. For '..\\sensitive.log':

  • path.posix.basename('..\\sensitive.log') → unchanged (backslash is a regular char on POSIX) → POSIX condition is false
  • path.win32.basename('..\\sensitive.log')'sensitive.log' → Win32 condition is true
  • false && true = false → traversal is not blocked

The value falls through to fs.existsSync, which returns false for a non-existent file, so the validator returns "does not exist." — directly failing the test added on line 130–140 of unitTests/validation/readLogValidator.test.js that expects "is invalid.".

Suggested fix: Change && to || on line 45. All plain filenames (hdb.log, clustering_connector) return identical values from both basename calls, so there are no false positives for valid inputs.

if (path.posix.basename(value) !== value || path.win32.basename(value) !== value) {

@DavidCockerill DavidCockerill marked this pull request as ready for review May 6, 2026 14:40
@DavidCockerill DavidCockerill requested a review from a team as a code owner May 6, 2026 14:40
Copy link
Copy Markdown
Member

@kriszyp kriszyp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great!

Copy link
Copy Markdown
Member

@cb1kenobi cb1kenobi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants