Documentation
¶
Overview ¶
Package security provides security utilities for validating command paths, file paths, and preventing injection attacks.
Index ¶
- Variables
- func EnsureDir(dir string, perm os.FileMode) error
- func IsAllowedCommand(cmdPath, category string) bool
- func IsPathSafe(path string) bool
- func SafeOpenFile(path, baseDir string) (*os.File, error)
- func ValidateAndResolveCommand(cmdPath, category string) (string, error)
- func ValidateCommandPath(cmdPath string) (string, error)
- func ValidateConfigPath(path, configDir string) (string, error)
- func ValidatePath(path string) (string, error)
- func ValidatePathWithinBase(path, baseDir string) (string, error)
Constants ¶
This section is empty.
Variables ¶
var AllowedCommands = map[string][]string{
"slurm": {"scontrol", "squeue", "scancel", "sinfo", "sacct"},
"ssh": {"ssh", "ssh-keygen", "ssh-add", "ssh-agent"},
"shell": {"bash", "sh", "zsh"},
"notification": {"notify-send", "osascript"},
"editor": {"vi", "vim", "nvim", "nano", "emacs", "code", "subl"},
}
AllowedCommands defines a whitelist of commands that are known to be safe for specific operations. This provides defense in depth beyond path validation.
Functions ¶
func EnsureDir ¶
EnsureDir creates a directory if it doesn't exist, with validation. It ensures the directory path is safe before creation.
func IsAllowedCommand ¶
IsAllowedCommand checks if a command is in the whitelist for a given category. This provides an additional security layer beyond path validation.
func IsPathSafe ¶
IsPathSafe performs basic safety checks on a path without requiring a base directory. Use this when you trust the path source but want to validate format.
func SafeOpenFile ¶
SafeOpenFile opens a file with path validation. Use this as a wrapper around os.Open when you need path validation.
func ValidateAndResolveCommand ¶
ValidateAndResolveCommand combines path validation with whitelist checking. It returns the absolute path to the command if it passes all checks.
func ValidateCommandPath ¶
ValidateCommandPath validates that a command path is safe to execute. It checks for: - Path traversal attempts (../) - Shell metacharacters that could enable command injection - Absolute paths that exist and are executable
For commands in PATH, it uses exec.LookPath to find the absolute path. For absolute paths, it verifies the file exists and is executable.
Security note: This helps prevent command injection but does not guarantee complete security. Always validate command arguments separately.
func ValidateConfigPath ¶
ValidateConfigPath validates a path is within the user's config directory. This is useful for config files, cache files, etc.
func ValidatePath ¶
ValidatePath validates that a file path is safe to use. It checks for: - Path traversal attempts (../) - Null bytes - Absolute path validation
Returns the cleaned absolute path if valid.
func ValidatePathWithinBase ¶
ValidatePathWithinBase ensures a path is within a base directory. This prevents path traversal attacks by ensuring the resolved path is within the allowed base directory.
Types ¶
This section is empty.
Source Files