From ee71e18e2a1bb6ec7408e1aea7975fc5992b1de7 Mon Sep 17 00:00:00 2001
From: Mariell Hoversholm <mariell.hoversholm@grafana.com>
Date: Thu, 28 Nov 2024 15:26:55 +0100
Subject: [PATCH] POC/Provisioning: Gosec: Fix/ignore gosec violations (#97166)

---
 .../provisioning/repository/github/real.go    |  2 +-
 .../apis/provisioning/repository/local.go     | 20 ++++++++++++++++---
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/pkg/registry/apis/provisioning/repository/github/real.go b/pkg/registry/apis/provisioning/repository/github/real.go
index faadd3294cd..ea8f08cbe28 100644
--- a/pkg/registry/apis/provisioning/repository/github/real.go
+++ b/pkg/registry/apis/provisioning/repository/github/real.go
@@ -67,7 +67,7 @@ func (r *realImpl) GetTree(ctx context.Context, owner, repository, ref string, r
 		return nil, false, err
 	}
 
-	var entries []RepositoryContent
+	entries := make([]RepositoryContent, 0, len(tree.Entries))
 	for _, te := range tree.Entries {
 		rrc := &realRepositoryContent{
 			real: &github.RepositoryContent{
diff --git a/pkg/registry/apis/provisioning/repository/local.go b/pkg/registry/apis/provisioning/repository/local.go
index 527521c7f56..d525a1c9ec3 100644
--- a/pkg/registry/apis/provisioning/repository/local.go
+++ b/pkg/registry/apis/provisioning/repository/local.go
@@ -2,6 +2,8 @@ package repository
 
 import (
 	"context"
+	// Git still uses sha1 for the most part: https://git-scm.com/docs/hash-function-transition
+	//nolint:gosec
 	"crypto/sha1"
 	"encoding/hex"
 	"errors"
@@ -143,6 +145,11 @@ func (r *localRepository) Read(ctx context.Context, logger *slog.Logger, path st
 	}
 
 	fullpath := filepath.Join(r.path, path)
+	// Treats https://securego.io/docs/rules/g304.html
+	if !strings.HasPrefix(fullpath, r.path) {
+		return nil, ErrFileNotFound
+	}
+
 	info, err := os.Stat(fullpath)
 	if errors.Is(err, os.ErrNotExist) {
 		return nil, ErrFileNotFound
@@ -156,7 +163,7 @@ func (r *localRepository) Read(ctx context.Context, logger *slog.Logger, path st
 		return nil, err
 	}
 
-	hash, _, err := r.calculateFileHash(ctx, fullpath)
+	hash, _, err := r.calculateFileHash(fullpath)
 	if err != nil {
 		return nil, err
 	}
@@ -189,7 +196,7 @@ func (r *localRepository) ReadTree(ctx context.Context, logger *slog.Logger, ref
 		}
 		if !info.IsDir() {
 			entry.Blob = true
-			entry.Hash, _, err = r.calculateFileHash(ctx, path)
+			entry.Hash, _, err = r.calculateFileHash(path)
 			if err != nil {
 				return fmt.Errorf("failed to read and calculate hash of path %s: %w", path, err)
 			}
@@ -201,7 +208,14 @@ func (r *localRepository) ReadTree(ctx context.Context, logger *slog.Logger, ref
 	return entries, err
 }
 
-func (r *localRepository) calculateFileHash(ctx context.Context, path string) (string, int64, error) {
+func (r *localRepository) calculateFileHash(path string) (string, int64, error) {
+	// Treats https://securego.io/docs/rules/g304.html
+	if !strings.HasPrefix(path, r.path) {
+		return "", 0, ErrFileNotFound
+	}
+
+	// We've already made sure the path is safe, so we'll ignore the gosec lint.
+	//nolint:gosec
 	file, err := os.OpenFile(path, os.O_RDONLY, 0)
 	if err != nil {
 		return "", 0, err