Add safe path join helper by selzoc · Pull Request #726 · cloudfoundry/bosh-cli

selzoc · 2026-05-06T20:34:05Z

No description provided.

coderabbitai · 2026-05-06T20:34:18Z

Warning

Rate limit exceeded

@selzoc has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 35 minutes and 10 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 53440846-05d1-408b-b3a4-0d2611d67c20

📥 Commits

Reviewing files that changed from the base of the PR and between 024dcea and 513ecef.

📒 Files selected for processing (10)

common/util/file_helper.go
common/util/file_helper_test.go
installation/installer.go
installation/installer_test.go
releasedir/fs_blobs_dir.go
releasedir/fs_blobs_dir_test.go
releasedir/index/fs_index_blobs.go
releasedir/index/fs_index_blobs_test.go
templatescompiler/job_renderer.go
templatescompiler/job_renderer_test.go

Walkthrough

The PR implements path traversal protection across the codebase by introducing a new SafeJoinPath utility function in common/util/file_helper.go that validates paths using filepath.IsLocal before joining them with a base directory. This function is then integrated into multiple modules including installation, releasedir blob handling, blob indexing, and template compilation. Each module's usage is accompanied by appropriate error handling and comprehensive test coverage to enforce path safety validation consistently.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	No pull request description was provided by the author, which is insufficient documentation for understanding the intent and scope of changes.	Add a detailed description explaining the security vulnerability being addressed, the SafeJoinPath function's purpose, and how it mitigates path traversal attacks.
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Add safe path join helper' accurately describes the main change: introducing a SafeJoinPath helper function for secure path handling across multiple files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch refactor-path-traversal

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

This PR introduces a shared SafeJoinPath helper to prevent path traversal/absolute-path writes when joining untrusted path fragments, and applies it in several file-creation/extraction code paths (template rendering, blob cache/index handling, and installer package/job extraction).

Changes:

Add common/util.SafeJoinPath(base, untrusted) built on filepath.IsLocal, plus unit tests.
Use SafeJoinPath to validate/join template destination paths, blob cache filenames, blobs index entries, and installer target directories.
Add/adjust tests to assert errors are returned for traversal/absolute/empty paths.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
templatescompiler/job_renderer.go	Validates template destination paths with `SafeJoinPath` before rendering.
templatescompiler/job_renderer_test.go	Adds coverage for rejecting non-local template destination paths.
releasedir/index/fs_index_blobs.go	Uses `SafeJoinPath` to prevent blob cache path traversal via digest strings.
releasedir/index/fs_index_blobs_test.go	Adds/updates tests for traversal/empty digest strings being rejected early.
releasedir/fs_blobs_dir.go	Validates blob paths from `blobs.yml` cannot escape the blobs directory.
releasedir/fs_blobs_dir_test.go	Adds tests for rejecting traversal/absolute blob paths in `blobs.yml`.
installation/installer.go	Validates package/job names before extracting blobs into target directories.
installation/installer_test.go	Adds tests ensuring traversal in package/job names is rejected.
common/util/file_helper.go	Adds `SafeJoinPath` helper.
common/util/file_helper_test.go	Adds unit tests for `SafeJoinPath` behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@releasedir/fs_blobs_dir.go`:
- Around line 104-107: TrackBlob and UntrackBlob currently join caller-provided
path directly and can escape d.dirPath; update both functions to call
util.SafeJoinPath(d.dirPath, path) at their entry, check the returned error and
return a bosherr.Errorf (matching the pattern in Blobs) if invalid, then use the
safe joined path for all subsequent file writes/removals instead of the raw path
or direct joins; ensure you reference d.dirPath, util.SafeJoinPath, and the
TrackBlob/UntrackBlob functions when making the change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 35074d7f-f88f-42c4-9eb8-6d7e1aa984f2

📥 Commits

Reviewing files that changed from the base of the PR and between 3752eea and 024dcea.

📒 Files selected for processing (10)

common/util/file_helper.go
common/util/file_helper_test.go
installation/installer.go
installation/installer_test.go
releasedir/fs_blobs_dir.go
releasedir/fs_blobs_dir_test.go
releasedir/index/fs_index_blobs.go
releasedir/index/fs_index_blobs_test.go
templatescompiler/job_renderer.go
templatescompiler/job_renderer_test.go

ai-assisted=yes [TNZ-94638] [TNZ-93973] Signed-off-by: Chris Selzo <chris.selzo@broadcom.com> Signed-off-by: Aram Price <aram.price@broadcom.com>

aramprice requested a review from Copilot May 6, 2026 20:37

Copilot started reviewing on behalf of aramprice May 6, 2026 20:37 View session

aramprice previously approved these changes May 6, 2026

View reviewed changes

Copilot AI reviewed May 6, 2026

View reviewed changes

Comment thread templatescompiler/job_renderer.go Outdated

coderabbitai Bot requested changes May 6, 2026

View reviewed changes

Comment thread releasedir/fs_blobs_dir.go

Add safe path join helper

513ecef

ai-assisted=yes [TNZ-94638] [TNZ-93973] Signed-off-by: Chris Selzo <chris.selzo@broadcom.com> Signed-off-by: Aram Price <aram.price@broadcom.com>

selzoc dismissed aramprice’s stale review via 513ecef May 6, 2026 20:56

selzoc force-pushed the refactor-path-traversal branch from 024dcea to 513ecef Compare May 6, 2026 20:56

coderabbitai Bot approved these changes May 6, 2026

View reviewed changes

aramprice approved these changes May 6, 2026

View reviewed changes

selzoc merged commit c280128 into main May 6, 2026
46 checks passed

selzoc deleted the refactor-path-traversal branch May 6, 2026 20:57

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add safe path join helper#726

Add safe path join helper#726
selzoc merged 1 commit intomainfrom
refactor-path-traversal

selzoc commented May 6, 2026

Uh oh!

coderabbitai Bot commented May 6, 2026 •

edited

Loading

Rate limit exceeded

❌ Failed checks (2 warnings)

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

selzoc commented May 6, 2026

Uh oh!

coderabbitai Bot commented May 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

❌ Failed checks (2 warnings)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

coderabbitai Bot commented May 6, 2026 •

edited

Loading