milliways-infosec/AikidoSec-safe-chain
7
0
Fork 0
mirror of https://github.com/AikidoSec/safe-chain.git synced 2026-05-26 12:10:49 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add unit tests

Browse source
This commit is contained in:
Reinier Criel 2025-12-05 15:40:14 -08:00
parent d0c5f35707
commit 2e9bae41f3
2 changed files with 207 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/safe-chain/src/registryProxy/certBundle.js
View file

@ -96,17 +96,17 @@ export function getCombinedCaBundlePath() {
}
/**
* Read and validate user certificate file with comprehensive security checks.
* Read and validate user certificate file
* @param {string} certPath - Path to certificate file
* @returns {string | null} Certificate PEM content or null if invalid/unreadable
*/
function readUserCertificateFile(certPath) {
try {
// Perform security checks before reading
if (typeof certPath !== "string" || certPath.trim().length === 0) {
return null;
}
// Path traversal protection - check for .. and multiple slashes
if (certPath.includes("..") || certPath.includes("//") || certPath.includes("\\\\")) {
return null;
}
@ -132,7 +132,7 @@ function readUserCertificateFile(certPath) {
return content;
} catch {
// Silently fail on any errors (permissions, parsing, etc.)
// Silently fail on any errors
return null;
}
}