Skip to content

Conversation

@paul-fresquet
Copy link
Contributor

[feature] Block protected POSIX paths from data sources

Summary

  • Block protected POSIX system paths (and subpaths) when adding local data sources
  • Add defense-in-depth rejection during inventory builder setup
  • Add localized user feedback and logging for blocked paths
  • Bump protocol version to V2 and update related tests

Main Changes

  • Added ProtectedPaths utility and unit tests
  • Integrated checks in DataSourceChecker and InventoryBuilder
  • Updated resources for new error messages
  • Updated protocol version constants and tests

Implementation Details

  • Path checks use Path.GetFullPath + TrimEndingDirectorySeparator and match exact or subpaths
  • Enforcement is local-only (by ClientInstanceId) to avoid blocking remote data sources
  • InventoryBuilderFactory catches per-source exceptions to keep other sources

Closes #260

@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 2, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[feature] Block dangerous system paths from inventory sources

2 participants