Skip to content

Check if PEM bundle is valid after downloading#283

Open
reiniercriel wants to merge 1 commit intomainfrom
feat/pem-bundle-validation
Open

Check if PEM bundle is valid after downloading#283
reiniercriel wants to merge 1 commit intomainfrom
feat/pem-bundle-validation

Conversation

@reiniercriel
Copy link
Copy Markdown
Contributor

@reiniercriel reiniercriel commented Apr 9, 2026

Summary by Aikido

⚠️ Security Issues: 1 Quality Issues: 0 ✅ Resolved Issues: 1

🚀 New Features

  • Introduced ReadAndValidatePEMBundle utility to validate PEM bundles on disk

⚡ Enhancements

  • Validated and removed downloaded proxy CA files when invalid

🔧 Refactors

  • Refactored certbundle to delegate PEM parsing to utils package

More info

return "", fmt.Errorf("refusing to read non-regular certificate bundle %s", path)
}

data, err := os.ReadFile(path)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.

Show fix

Remediation: Ignore this issue only after you've verified or sanitized the input going into this function.

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant