Questions & Help>Questions

How to resolve sobelow flagging out file paths thats coming from external environment

/phoenix#sobelow
laiboonh

laiboonh

How to resolve sobelow flagging out file paths thats coming from external environment

I have a phoenix endpoint which allows users to upload file and system will ingest the files contents

def ingest_csv(conn, %{"csv" => %Plug.Upload{} = upload}) do
  csv_data = upload.path |> File.stream!() |> CSV.parse_stream() |> Enum.to_list()
  ...
end

sobelow is flagging this out Traversal.FileModule: Directory Traversal in File.stream!- High Confidence

Ensure that the path passed to File functions is not user-controlled.

It seems is is flagging this out as the file path is coming from external environment.

So how else can i implement this feature without triggering sobelow?

1 comment
#sobelow
0 56 1

First Post!

laiboonh

laiboonh

Just as an update: I have marked out the above code as false positive via comment and used --skip option to skip false positives

Post #2

Where Next?

View thread on forum (has 1 response!)
phoenix
sobelow
Home Questions & Help>Questions
/phoenix#sobelow
0 57 1
Last post

Popular in Questions Top

minhajuddin
Questions & Help>Questions

Using List.first instead of Enum.at(0)
I have seen a lot of code which picks the first element from a list using Enum.at(0) instead of List.first. Is there a reason why people ...
#code-style
76 33273 14
New
Harrisonl
Questions & Help>Questions

Deploying Elixir into ECS causing many "'global' at node :"xxxxx@10.0.X.X" requested disconnect from node :"xxxx@10.0.X.X" in order to prevent overlapping partitions"
We have an ECS cluster with 4 services, where each task joins a single cluster, via discovery ECS discovery service. Currently when I de...
#deployment
2 85219 3
New
logicmason
Questions & Help>Questions

What's the best way to serve restricted ports (e.g. 80, 443) with Phoenix?
Hi there, I'm working through my first release with elixir/phoenix. I've built a release with distillery and found that it crashes when I...
/phoenix#deployment#linux
32 16824 13
New
srinivasu
Questions & Help>Questions

Best Practises for Error handling elixir?
How to handle excepions in elixir? Suppose i have A, B, C ,D, E modules. and each module has get() function. A.get() method will call th...
16 16061 9
New
pmjoe
Questions & Help>Questions

What do you think of Gleam compared to Elixir?
I have a relationship of love and hate with Elixir. Lots of things are just absolutely right, but there are some things that are kind of ...
#programminguages#gleam
24 16555 10
New
joaquinalcerro
Questions & Help>Questions

What is the best approach for fetching large amount of records from postgresql with ecto
Hi there, I am working with Ecto-Postgresql and I need to call all of the records from a specific table but the table has 40,000 record...
#ecto
126 24587 27
New
nsuchy
Questions & Help>Questions

IEX in Windows Powershell?
Hi. I’ve noticed that Windows Powershell has it’s own IEX command and you cannot access Elixir’s IEX due to the conflict. This isn’t a cr...
#iex#microsoft-windows#windows#powershell
15 29309 4
New
vertexbuffer
Questions & Help>Questions

Deleting item from a list
Hello, can anybody help here..? I have a list of players and I what to delete an element, but every for loop the list is reverting to ori...
7 24097 4
New
ashish173
Questions & Help>Questions

Difference in between :utc_datetime and :naive_datetime in Ecto
I am using Ecto timestamps with postgres, I can see the timestamps() use the :naive_dateime but for my use case I wanted to store the ti...
#ecto#timestamps
79 27907 15
New
Qqwy
Questions & Help>Questions

Updating structs: Map.put vs %Foo{oldfoo | new: value} vs put_in
Original source of discussion: This topic on the Pragmatic Programmers' Functional Web Development with Elixir, OTP, and Phoenix forum. ...
#maps#structs#pipeline#access
115 28410 31
New

Other popular topics Top

Harrisonl
Questions & Help>Questions

Deploying Elixir into ECS causing many "'global' at node :"xxxxx@10.0.X.X" requested disconnect from node :"xxxx@10.0.X.X" in order to prevent overlapping partitions"
We have an ECS cluster with 4 services, where each task joins a single cluster, via discovery ECS discovery service. Currently when I de...
#deployment
2 85219 3
New
sorentwo
News>Announcing

Oban - Reliable and Observable Job Processing
Hello! tl;dr Announcing Oban, an Ecto based job processing library with a focus on reliability and historical observability. After spen...
/oban#ecto#postgres#job-processing
977 41022 311
New
itssasanka
Questions & Help>Questions

Why use `utc_datetime` over `naive_datetime` for Ecto?
Hi all, Trying to get some more clarity over utc_datetime and naive_datetime for Ecto: https://hexdocs.pm/ecto/Ecto.Schema.html#module-...
#ecto#timestamps#datetime#timezones
115 14814 19
New
AstonJ
Learning Resources>Courses

Elixir for Programmers (PragDave)
You’re a programmer, so you don’t need spoon feeding with the conventional drivel about “this is an integer.” No. You need to know what’s...
#elixir-for-programmers-course
201 29468 78
New
danschultzer
Libraries & Projects>Libraries

Pow: Robust, modular, extendable user authentication and management system
None of the current solutions worked well for me, so I went ahead and built a user management system from scratch. This project took far...
/phoenix#authentication#library#authorization#user_system#pow
548 27727 240
New
aadeshere1
Questions & Help>Questions

Write while loop equivalent in elixir
I have a another noob question about loop. Since elixir is immutable, while loop is not directly possible. total = 10 while total != 0 ...
#while#loop
60 28200 36
New
beno
Questions & Help>Questions

Pattern match with multiple match options
I will often find my self writing things similar to: case some_value do nil -> something() "" -> something() _ -> someth...
#pattern-matching#how-to-question
29 15490 6
New
AstonJ
Chat & Discussions>Wikis

Phoenix LiveView Info
We’ve put together this wiki for Phoenix LiveView - please feel free to add any info you feel is worth including. What is Phoenix LiveV...
/phoenix#wiki#stickies#liveview
220 25307 74
New
AstonJ
Learning Resources>Books

Functional Web Development with Elixir, OTP, and Phoenix (Pragprog)
by Lance Halvorsen Elixir and Phoenix are generating tremendous excitement as an unbeatable platform for building modern web application...
#book-functional-web-development-with-elixir-otp-and-phoenix#pragprog
460 27162 124
New
siddhant3030
Questions & Help>Questions

How can I write a raw sql query?
Hi, I have to write a raw query for one of my project. But till now I have used ecto queries and don’t have much experience writing raw ...
/phoenix#ecto
13 19061 20
New
Back to top

Latest Phoenix Threads

Phoenix Forum ❯

Questions & Help>Questions

Questions Questions ❯

Latest on Elixir Forum

Elixir Forum ❯

Sponsor Spotlight

Dashbit

Build Elixir applications with speed and confidence.

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

Categories:

Sub Categories:

Forums

Our Sponsors

Dashbit

Build Elixir applications with speed and confidence.

EEF

Supporting innovation across the BEAM ecosystem.

Coders51

We build reliable cloud platforms for business-critical systems.

AppSignal

Catch errors, track performance, monitor hosts and more.

Manning

Develop your skills with books, videos, and courses.

WyewWorks

Enabling companies to succeed by building software people love.

Potions

The deployment platform built for Elixir: PaaS ease, VPS control.

Pragmatic Studio

Courses that'll move you from confusion to "Aha, now I get it!"

View all our sponsors ❯

We're in Beta

About us Mission Statement