added filepath.Clean for better secuirty

ngmisl · Jun 11, 2024 · 9797aec · 9797aec
1 parent 9013fa4
commit 9797aec
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 7 deletions.
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module example.com/jpe
 
-go 1.22.2
+go 1.22.4
 
 require github.com/gen2brain/jpegli v0.2.2
 

diff --git a/go.sum b/go.sum
@@ -1,7 +1,3 @@
-github.com/gen2brain/jpegli v0.1.2 h1:2BFpt6sdze/ROP/zGiKWOiKaNZCxqDcS7I0/oNksJog=
-github.com/gen2brain/jpegli v0.1.2/go.mod h1:ArNook7A3NfU+ibQ5gko0DgQKilME4Q0sEt9rcSPaN8=
-github.com/gen2brain/jpegli v0.2.0 h1:v12qDA6zydwvp4AxtwlC791OT11tMAExKiaTT7BhFlU=
-github.com/gen2brain/jpegli v0.2.0/go.mod h1:ArNook7A3NfU+ibQ5gko0DgQKilME4Q0sEt9rcSPaN8=
 github.com/gen2brain/jpegli v0.2.2 h1:GrhioJ/ZqrI+N4gKMBs+sggCipBEU141MJwQKJYAmbo=
 github.com/gen2brain/jpegli v0.2.2/go.mod h1:ArNook7A3NfU+ibQ5gko0DgQKilME4Q0sEt9rcSPaN8=
 github.com/tetratelabs/wazero v1.7.0 h1:jg5qPydno59wqjpGrHph81lbtHzTrWzwwtD4cD88+hQ=

diff --git a/main.go b/main.go
@@ -44,7 +44,7 @@ func main() {
 
 	for _, arg := range os.Args[1:] {
 		// Read the input PNG image from a file
-		inputImageBytes, err := os.ReadFile(arg)
+		inputImageBytes, err := os.ReadFile(filepath.Clean(arg))
 		if err != nil {
 			log.Printf("Error reading PNG file %s: %v", arg, err)
 			continue
@@ -87,7 +87,7 @@ func main() {
 		outputFilename := filepath.Base(arg[:len(arg)-len(filepath.Ext(arg))]) + ".jpeg"
 		outputPath := filepath.Join(outputDir, outputFilename)
 
-		if err := os.WriteFile(outputPath, jpegliBytes, 0644); err != nil {
+		if err := os.WriteFile(filepath.Clean(outputPath), jpegliBytes, 0644); err != nil {
 			log.Printf("Error saving Jpegli file %s: %v", outputPath, err)
 			continue
 		}