fixing security issue

Signed-off-by: Atul-source <atulprajapati6031@gmail.com>

.github/workflows/codeql.yaml

@@ -26,25 +26,48 @@ jobs:
       actions: read
       contents: read
       security-events: write
-
+      
     strategy:
       fail-fast: false
       matrix:
         language: [ 'go' ]
 
     steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde
-      with:
-        egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
-
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
+      uses: actions/checkout@2d7d9f7ff5b310f983d059b68785b3c74d8b8edd
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93
+      uses: github/codeql-action/init@e1f83c153a6cb7134f035e16e2626b216e7168c9
       with:
         languages: ${{ matrix.language }}
 
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@9e39a05578dd315aad814d3c71bd03472cc5b815
+
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@4dd16135b69a43b6c8efb853346f8437d92d3c93
+      uses: github/codeql-action/analyze@4067cdab784c667cf1b7fa95169f3a0e0a381d63
+      with:
+        category: "/language:${{matrix.language}}"
+        output: sarif-results
+        upload: failure-only
+
+    - name: filter-sarif
+      uses: advanced-security/filter-sarif@59d0a64b3c0a34d787819f6659708915b6210582
+      with:
+        patterns: |
+          +**/*.go
+          -artifact/artifact.go
+        input: sarif-results/go.sarif
+        output: sarif-results/go.sarif
+
+    - name: Upload SARIF
+      uses: github/codeql-action/upload-sarif@2bbafcdd7fbf96243689e764c2f15d9735164f33
+      with:
+        sarif_file: sarif-results/go.sarif
+
+    - name: Upload loc as a Build Artifact
+      uses: actions/upload-artifact@b18b1d32f3f31abcdc29dee3f2484801fe7822f4
+      with:
+        name: sarif-results
+        path: sarif-results
+        retention-days: 1

apis/handlers/restart_linux.go

@@ -11,12 +11,14 @@ import (
 	"net"
 	"os"
 	"os/exec"
+	"regexp"
 	"strconv"
 	"strings"
 	"syscall"
 	"time"
 
 	"net/http"
+	"net/url"
 
 	"github.com/rs/zerolog/log"
 
@@ -71,6 +73,46 @@ func HandleRestart(bpfcfg *bpfprogs.NFConfigs) http.HandlerFunc {
 			statusCode = http.StatusInternalServerError
 			return
 		}
+
+		match, _ := regexp.MatchString(`^v\d+\.\d+\.\d+$`, t.Version)
+		if !match {
+			mesg = fmt.Sprintf("version naming convention is wrong it will like vx.y.z")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
+		machineHostname, err := os.Hostname()
+		if err != nil {
+			mesg = fmt.Sprintf("failed to get os hostname")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
+		if machineHostname != t.HostName {
+			mesg = fmt.Sprintf("this api request is not for provided host")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
+		URL, err := url.Parse(t.ArtifactURL)
+		if err != nil {
+			mesg = fmt.Sprintf("url format is wrong")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
+		if URL.Scheme != models.HttpScheme && URL.Scheme != models.FileScheme && URL.Scheme != models.HttpsScheme {
+			mesg = fmt.Sprintf("currently only http,https,file is supported")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
+		if strings.Contains(t.ArtifactURL, "..") {
+			mesg = fmt.Sprintf("bad string")
+			log.Error().Msg(mesg)
+			statusCode = http.StatusInternalServerError
+			return
+		}
 		defer func() {
 			models.IsReadOnly = false
 		}()
@@ -88,14 +130,14 @@ func HandleRestart(bpfcfg *bpfprogs.NFConfigs) http.HandlerFunc {
 
 		err, oldCfgPath := restart.ReadSymlink(bpfcfg.HostConfig.BasePath + "/latest/l3afd.cfg")
 		if err != nil {
-			mesg = fmt.Sprintf("failed read simlink: %v", err)
+			mesg = fmt.Sprintf("failed read symlink: %v", err)
 			log.Error().Msg(mesg)
 			statusCode = http.StatusInternalServerError
 			return
 		}
 		err, oldBinPath := restart.ReadSymlink(bpfcfg.HostConfig.BasePath + "/latest/l3afd")
 		if err != nil {
-			mesg = fmt.Sprintf("failed to read simlink: %v", err)
+			mesg = fmt.Sprintf("failed to read symlink: %v", err)
 			log.Error().Msg(mesg)
 			statusCode = http.StatusInternalServerError
 			return
@@ -179,22 +221,22 @@ func HandleRestart(bpfcfg *bpfprogs.NFConfigs) http.HandlerFunc {
 		err = cmd.Start()
 		if err != nil {
 			log.Error().Msgf("%v", err)
-			mesg = mesg + fmt.Sprintf("not able to start new instance %v", err)
+			mesg = mesg + fmt.Sprintf("unable to start new instance %v", err)
 			// write a function a to do cleanup of other process if necessary
 			err = cmd.Process.Kill()
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to kill the new instance %v", err)
+				mesg = mesg + fmt.Sprintf("unable to kill the new instance %v", err)
 			}
 			err = bpfcfg.StartAllUserProgramsAndProbes()
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to start all userprograms and probes: %v", err)
+				mesg = mesg + fmt.Sprintf("unable to start all userprograms and probes: %v", err)
 			}
 			err = pidfile.CreatePID(bpfcfg.HostConfig.PIDFilename)
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to create pid file: %v", err)
+				mesg = mesg + fmt.Sprintf("unable to create pid file: %v", err)
 			}
 			err = restart.RollBackSymlink(oldCfgPath, oldBinPath, oldVersion, t.Version, bpfcfg.HostConfig)
 			if err != nil {
@@ -242,17 +284,17 @@ func HandleRestart(bpfcfg *bpfprogs.NFConfigs) http.HandlerFunc {
 				err = cmd.Process.Kill()
 				if err != nil {
 					log.Error().Msgf("%v", err)
-					mesg = mesg + fmt.Sprintf("not able to kill the new instance %v", err)
+					mesg = mesg + fmt.Sprintf("unable to kill the new instance %v", err)
 				}
 				err = bpfcfg.StartAllUserProgramsAndProbes()
 				if err != nil {
 					log.Error().Msgf("%v", err)
-					mesg = mesg + fmt.Sprintf("not able to start all userprograms and probes: %v", err)
+					mesg = mesg + fmt.Sprintf("unable to start all userprograms and probes: %v", err)
 				}
 				err = pidfile.CreatePID(bpfcfg.HostConfig.PIDFilename)
 				if err != nil {
 					log.Error().Msgf("%v", err)
-					mesg = mesg + fmt.Sprintf("not able to create pid file: %v", err)
+					mesg = mesg + fmt.Sprintf("unable to create pid file: %v", err)
 				}
 				err = restart.RollBackSymlink(oldCfgPath, oldBinPath, oldVersion, t.Version, bpfcfg.HostConfig)
 				if err != nil {
@@ -273,17 +315,17 @@ func HandleRestart(bpfcfg *bpfprogs.NFConfigs) http.HandlerFunc {
 			err = cmd.Process.Kill()
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to kill the new instance %v", err)
+				mesg = mesg + fmt.Sprintf("unable to kill the new instance %v", err)
 			}
 			err = bpfcfg.StartAllUserProgramsAndProbes()
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to start all userprograms and probes: %v", err)
+				mesg = mesg + fmt.Sprintf("unable to start all userprograms and probes: %v", err)
 			}
 			err = pidfile.CreatePID(bpfcfg.HostConfig.PIDFilename)
 			if err != nil {
 				log.Error().Msgf("%v", err)
-				mesg = mesg + fmt.Sprintf("not able to create pid file: %v", err)
+				mesg = mesg + fmt.Sprintf("unable to create pid file: %v", err)
 			}
 			err = restart.RollBackSymlink(oldCfgPath, oldBinPath, oldVersion, t.Version, bpfcfg.HostConfig)
 			if err != nil {