Skip to content

chore: backport to v3 - #2239

Merged
butler54 merged 3 commits into
v3from
security/path-traversal-v3
May 21, 2026
Merged

chore: backport to v3#2239
butler54 merged 3 commits into
v3from
security/path-traversal-v3

Conversation

@butler54

@butler54 butler54 commented May 21, 2026

Copy link
Copy Markdown
Collaborator

Types of changes

  • Hot fix (emergency fix and release)
  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Documentation (change which affects the documentation site)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Release (develop -> main)

Quality assurance (all should be covered).

  • My code follows the code style of this project.
  • Documentation for my change is up to date?
  • My PR meets testing requirements.
  • All new and existing tests passed.
  • All commits are signed-off.

Summary

Key links:

Before you merge

  • Ensure it is a 'squash commit' if not a release.
  • Ensure CI is currently passing
  • Check sonar. If you are working for a fork a maintainer will reach out, if required.

butler54 and others added 2 commits May 21, 2026 14:03
@butler54 @claude
fix: add path traversal and SSRF security controls for remote cache
5c65c59 
Backport security fixes from develop to v3:
- Add PathSecurityValidator for path traversal prevention
- Add URLSecurityValidator for SSRF prevention
- Add local file path validation
- Add SECURITY.md with security policy
- Update README.md with security section

Cherry-picked from: 89f4e53, d00a0c2, 140acb2, 53de5e7

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Chris Butler <chris.butler@redhat.com>
@butler54 @claude
fix: add path traversal protection and prevent SSTI in jinja templating
7d107b3 
Backport jinja security fixes from develop to v3:
- Add PathSecurityValidator checks on output paths
- Remove recursive template evaluation to prevent SSTI
- Add _create_jinja_environment factory
- Add comprehensive jinja security tests

Cherry-picked from: 2dd1cce, 247fcce

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Chris Butler <chris.butler@redhat.com>
@butler54
butler54 requested a review from a team as a code owner May 21, 2026 08:50
@butler54 butler54 changed the title Backport fixes chore: backport May 21, 2026
@butler54 butler54 changed the title chore: backport chore: backport to v3 May 21, 2026
vikas-agarwal76
vikas-agarwal76 approved these changes May 21, 2026
View reviewed changes

@vikas-agarwal76 vikas-agarwal76 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, but SONAR is failing.

@butler54
butler54 merged commit 9abc492 into v3 May 21, 2026
13 of 16 checks passed
@butler54
butler54 deleted the security/path-traversal-v3 branch May 21, 2026 13:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@vikas-agarwal76 vikas-agarwal76 vikas-agarwal76 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@butler54 @vikas-agarwal76