laiboonh
How to resolve sobelow flagging out file paths thats coming from external environment
I have a phoenix endpoint which allows users to upload file and system will ingest the files contents
def ingest_csv(conn, %{"csv" => %Plug.Upload{} = upload}) do
csv_data = upload.path |> File.stream!() |> CSV.parse_stream() |> Enum.to_list()
...
end
sobelow is flagging this out Traversal.FileModule: Directory Traversal in File.stream!- High Confidence
Ensure that the path passed to File functions is not user-controlled.
It seems is is flagging this out as the file path is coming from external environment.
So how else can i implement this feature without triggering sobelow?
First Post!
laiboonh
Just as an update: I have marked out the above code as false positive via comment and used --skip option to skip false positives
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Supporting innovation across the BEAM ecosystem.
Categories:
Sub Categories:
Forums
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Practical resources that improve the lives of professional developers.
Producing high quality Elixir screencasts since 2017.
Enabling companies to succeed by building software people love.
Courses that'll move you from confusion to "Aha, now I get it!"