loafle/openapi-generator
3
0
Fork 0
forked from loafle/openapi-generator-original
Code Pull Requests Activity

[Go] Address Gosec vulnerabilities in Go client mustache template (#12540)

Browse Source 
* Fix potential file inclusion via variable

* Fix deferring unsafe method "Close" on type "*os.File"

* Update samples

* Correction to use existing variable

* Correction generated samples
This commit is contained in:
Beppe Catanese 2022-06-11 03:10:48 +02:00 committed by GitHub
parent 45f430f5c8
commit aeb40ab0ae
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
modules/openapi-generator/src/main/resources/go/client.mustache vendored
View File

@ -457,11 +457,14 @@ func (c *APIClient) decode(v interface{}, b []byte, contentType string) (err err
// Add a file to the multipart request // Add a file to the multipart request
func addFile(w *multipart.Writer, fieldName, path string) error { func addFile(w *multipart.Writer, fieldName, path string) error {
file, err := os.Open(path) file, err := os.Open(filepath.Clean(path))
if err != nil {
return err
}
err = file.Close()
if err != nil { if err != nil {
return err return err
} }
defer file.Close()
part, err := w.CreateFormFile(fieldName, filepath.Base(path)) part, err := w.CreateFormFile(fieldName, filepath.Base(path))
if err != nil { if err != nil {

7
samples/client/petstore/go/go-petstore/client.go
View File

@ -417,11 +417,14 @@ func (c *APIClient) decode(v interface{}, b []byte, contentType string) (err err
// Add a file to the multipart request // Add a file to the multipart request
func addFile(w *multipart.Writer, fieldName, path string) error { func addFile(w *multipart.Writer, fieldName, path string) error {
file, err := os.Open(path) file, err := os.Open(filepath.Clean(path))
if err != nil {
return err
}
err = file.Close()
if err != nil { if err != nil {
return err return err
} }
defer file.Close()
part, err := w.CreateFormFile(fieldName, filepath.Base(path)) part, err := w.CreateFormFile(fieldName, filepath.Base(path))
if err != nil { if err != nil {

7
samples/openapi3/client/extensions/x-auth-id-alias/go-experimental/client.go
View File

@ -402,11 +402,14 @@ func (c *APIClient) decode(v interface{}, b []byte, contentType string) (err err
// Add a file to the multipart request // Add a file to the multipart request
func addFile(w *multipart.Writer, fieldName, path string) error { func addFile(w *multipart.Writer, fieldName, path string) error {
file, err := os.Open(path) file, err := os.Open(filepath.Clean(path))
if err != nil {
return err
}
err = file.Close()
if err != nil { if err != nil {
return err return err
} }
defer file.Close()
part, err := w.CreateFormFile(fieldName, filepath.Base(path)) part, err := w.CreateFormFile(fieldName, filepath.Base(path))
if err != nil { if err != nil {

7
samples/openapi3/client/petstore/go/go-petstore/client.go
View File

@ -430,11 +430,14 @@ func (c *APIClient) decode(v interface{}, b []byte, contentType string) (err err
// Add a file to the multipart request // Add a file to the multipart request
func addFile(w *multipart.Writer, fieldName, path string) error { func addFile(w *multipart.Writer, fieldName, path string) error {
file, err := os.Open(path) file, err := os.Open(filepath.Clean(path))
if err != nil {
return err
}
err = file.Close()
if err != nil { if err != nil {
return err return err
} }
defer file.Close()
part, err := w.CreateFormFile(fieldName, filepath.Base(path)) part, err := w.CreateFormFile(fieldName, filepath.Base(path))
if err != nil { if err != nil {