-
Notifications
You must be signed in to change notification settings - Fork 94
Open
Description
blob-csi-driver/pkg/blob/blob.go
Line 601 in 1f8185b
| azureOAuthTokenFile := filepath.Join(defaultAzureOAuthTokenDir, clientID+accountName) |
The file path is constructed by directly concatenating clientID and accountName without any sanitization or validation. If clientID contains path traversal characters like "../" or if it's empty, this could lead to unexpected file paths issues. Consider validating clientID for invalid characters or using a safer path construction method like filepath.Clean() after ensuring clientID is non-empty.
What happened:
What you expected to happen:
How to reproduce it:
Anything else we need to know?:
Environment:
- CSI Driver version:
- Kubernetes version (use
kubectl version): - OS (e.g. from /etc/os-release):
- Kernel (e.g.
uname -a): - Install tools:
- Others:
Copilot
Metadata
Metadata
Assignees
Labels
No labels