This commit is contained in:
Malcolm Holmes
2021-12-06 18:19:01 +00:00
parent d8ce54553f
commit a38ec114cb
+2 -2
View File
@@ -285,7 +285,7 @@ func (hs *HTTPServer) getPluginAssets(c *models.ReqContext) {
requestedFile := filepath.Clean(filepath.Join("/", web.Params(c.Req)["*"]))
rel, err := filepath.Rel("/", requestedFile)
if err != nil {
// slash is prepended above therefore this is not expected to fail
// slash is prepended above therefore this is not expected to fail
c.JsonApiErr(500, "Failed to get the relative path", err)
return
}
@@ -300,7 +300,7 @@ func (hs *HTTPServer) getPluginAssets(c *models.ReqContext) {
c.JsonApiErr(500, "Failed to get plugin absolute path", nil)
return
}
pluginFilePath := filepath.Join(absPluginDir, rel)
// It's safe to ignore gosec warning G304 since we already clean the requested file path and subsequently
// use this with a prefix of the plugin's directory, which is set during plugin loading