diff --git a/pkg/yqlib/file_utils.go b/pkg/yqlib/file_utils.go index cfe8d2c4..4c18823e 100644 --- a/pkg/yqlib/file_utils.go +++ b/pkg/yqlib/file_utils.go @@ -3,6 +3,7 @@ package yqlib import ( "io" "os" + "path/filepath" ) func safelyRenameFile(from string, to string) { @@ -25,7 +26,7 @@ func safelyRenameFile(from string, to string) { // thanks https://stackoverflow.com/questions/21060945/simple-way-to-copy-a-file-in-golang func copyFileContents(src, dst string) (err error) { - in, err := os.Open(src) // nolint gosec + in, err := os.Open(filepath.Clean(src)) if err != nil { return err } diff --git a/pkg/yqlib/utils.go b/pkg/yqlib/utils.go index dd93d248..6786f1b4 100644 --- a/pkg/yqlib/utils.go +++ b/pkg/yqlib/utils.go @@ -5,6 +5,7 @@ import ( "container/list" "io" "os" + "path/filepath" yaml "gopkg.in/yaml.v3" ) @@ -13,7 +14,7 @@ func readStream(filename string) (io.Reader, error) { if filename == "-" { return bufio.NewReader(os.Stdin), nil } else { - return os.Open(filename) // nolint gosec + return os.Open(filepath.Clean(filename)) } } diff --git a/test/utils.go b/test/utils.go index 3cd61385..9af291c0 100644 --- a/test/utils.go +++ b/test/utils.go @@ -5,6 +5,7 @@ import ( "fmt" "io/ioutil" "os" + "path/filepath" "reflect" "strings" "testing" @@ -81,7 +82,7 @@ func WriteTempYamlFile(content string) string { } func ReadTempYamlFile(name string) string { - content, _ := ioutil.ReadFile(name) + content, _ := ioutil.ReadFile(filepath.Clean(name)) return string(content) }