Feat/85 fix the open security and vulnerability findings by kelvinprabhu · Pull Request #88 · OpenAgriNet/network-adapter

kelvinprabhu · 2026-10-22T07:26:42Z

Summary

Fixes the code-scanning findings for #85 that are not yet on development:
the kin-openapi CVEs (alerts #78–#84) and hardening plus tests for the
plugin zip extraction (alert #47).

The other 27 open alerts (Go stdlib, x/net, amqp091-go, OpenTelemetry)
are already fixed on development (eac74d96, f1e17956, c093f1f0).
They are still open only because code scanning runs on main, which is
85 commits behind development. They close with the next release PR.

Fixed in this PR

`github.com/getkin/kin-openapi` v0.144.0 → v0.149.0 — `dd39ce04`

The CVEs are in the library itself; our code was not changed. Bumped to
v0.149.0, the highest fixed version any of the CVEs needs. Only used by the
schemav2validator plugin, so it shows in the go.mod scan but not the
server image scan.

Alert	CVE	Severity	Issue	Fixed in	Commit
79	CVE-2026-100351	HIGH	Auth bypass via URL path decoding	0.147.0	`dd39ce0`
78	CVE-2026-100349	HIGH	DoS: nil deref in response validation	0.146.0	`dd39ce0`
80	CVE-2026-100352	HIGH	DoS: non-finite numbers	0.148.0	`dd39ce0`
81	CVE-2026-100353	HIGH	DoS: nil deref in request validation	0.149.0	`dd39ce0`
82	CVE-2026-100354	HIGH	DoS: unbounded schema recursion	0.149.0	`dd39ce0`
83	CVE-2026-100347	MEDIUM	DoS: unsupported HTTP methods	0.145.0	`dd39ce0`
84	CVE-2026-100348	MEDIUM	kin-openapi < 0.145	0.145.0	`dd39ce0`
47	go/zipslip (CWE-22)	HIGH	Zip entry escapes plugin dir	guard `c093f1f`	`1f55922`, `21a679f`

Transitive: santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3.

Alert #47 — `go/zipslip` (CWE-22), `pkg/plugin/manager.go` — `1f559223`,

21a679f9

unzip() extracts plugin archives from cfg.RemoteRoot. On main it joins
the attacker-controlled entry name to dest with no check, so ../../x
writes outside the plugin dir. development already has the HasPrefix
guard (c093f1f0). This PR closes the remaining gaps in the same path:

Change	Why
Reject non-regular entries (symlinks, devices)	A symlink inside `dest` could redirect a later entry's write outside it (CWE-59)
Create directory entries with `MkdirAll`	`os.Create` on `name/` failed and aborted extraction
Per-entry `extractZipFile` helper	Deferred closes inside the loop held every FD until return (CWE-775); `dst` close error is now returned
100 MiB cap per entry via `io.LimitReader`	Zip bomb could fill the disk (CWE-409)
`0755`/`0644` instead of `os.ModePerm`	Do not create world-writable paths (CWE-732)

Tests (pkg/plugin/manager_test.go):

../../evil.txt traversal is rejected
An absolute entry name stays inside dest
A symlink entry is rejected
An entry over the size cap is rejected and an entry at the cap is allowed
A directory entry is extracted as a directory

Refs #85

Addresses code scanning alert #47 (go/zipslip, CWE-22). The zip-slip guard in unzip() already stops "../" entries from escaping dest. Close the remaining gaps in the same extraction path: - Create directory entries with MkdirAll instead of failing on os.Create. - Reject non-regular entries (symlinks, devices); a symlink inside dest could redirect a later entry's write outside it (CWE-59). - Move per-entry extraction into extractZipFile so src/dst files close each iteration instead of piling up deferred closes until return, and surface the dst Close error (CWE-775). - Cap each entry at 100 MiB via io.LimitReader to stop zip-bomb disk exhaustion (CWE-409). - Use 0755/0644 instead of os.ModePerm for created paths (CWE-732). Tests cover a directory entry in the success case and symlink rejection in the failure cases. Refs #85

github.com/getkin/kin-openapi v0.144.0 -> v0.149.0 (used by schemav2validator). Clears code scanning alerts #78-#84: - CVE-2026-100351 (HIGH) auth bypass via URL path decoding discrepancy - CVE-2026-100349 (HIGH) DoS via nil pointer deref in response validation - CVE-2026-100352 (HIGH) DoS via non-finite number handling - CVE-2026-100353 (HIGH) DoS via nil pointer deref in request validation - CVE-2026-100354 (HIGH) DoS via unbounded schema recursion - CVE-2026-100347 (MEDIUM) DoS via unsupported HTTP methods on static routes - CVE-2026-100348 (MEDIUM) fixed in 0.145.0 Transitive: santhosh-tekuri/jsonschema/v6 v6.0.2 -> v6.0.3. Refs #85

Extends the zip extraction tests for code scanning alert #47 (go/zipslip, CWE-22) and the hardening in 1f55922: - TestUnzipAbsolutePathStaysInDest: an absolute entry name is joined under dest and never written to its absolute location. - TestUnzipOversizedEntry: an entry one byte over maxUnzipFileSize is rejected (CWE-409 zip bomb); an entry exactly at the cap still extracts. maxUnzipFileSize becomes an int64 var so the test can lower the cap instead of writing a 100 MiB fixture. Default is unchanged. Refs #85

github-actions · 2026-10-22T07:30:12Z

🛡️ Trivy security scan (CRITICAL,HIGH,MEDIUM,LOW)

View full run

Go dependencies

No findings at CRITICAL,HIGH,MEDIUM,LOW.

Container image

No findings at CRITICAL,HIGH,MEDIUM,LOW.

github-actions · 2026-10-22T07:30:49Z

📊 Test Coverage: ➖ Not applicable — no non-test Go files changed vs origin/development, so there are no lines to measure and no percentage to report.

manjudr · 2026-10-22T08:51:11Z

@kelvinprabhu - Security check is failing.. Can you fix that?

manjudr · 2026-10-22T09:06:55Z

@kelvinprabhu - Please simplify the PR description and address the review comments provided.

Move the toolchain from 1.26.9 to the latest 1.26 patch release: - go.mod: go 1.26.9 -> go 1.26.10 - Dockerfile.adapter, Dockerfile.adapter-with-plugins: golang:1.26.9-bookworm -> golang:1.26.10-bookworm - README.md: prerequisite floor updated to match CI workflows read go-version-file: go.mod, so they follow without edits. All open Go stdlib alerts were already cleared by 1.26.9 (eac74d9); this keeps the builder on the newest patch release. Verified with go1.26.10: make build and make test pass; Trivy go.mod scan shows 0 findings at CRITICAL,HIGH,MEDIUM,LOW. Refs #85

Reverts 21a679f and 1f55922. The plugin bundle is operator-supplied and holds .so files the adapter executes, so whoever controls the zip already has code execution; symlink rejection and the size cap add no real protection there. Alert #47 (go/zipslip) is closed by the HasPrefix guard from c093f1f, which stays.

kelvinprabhu

Done Review

…yignore

Cut the openpgp explanation down to two lines, per review.

kelvinprabhu added 3 commits October 22, 2026 12:26

manjudr reviewed Oct 22, 2026

View reviewed changes

Comment thread pkg/plugin/manager.go Outdated

kelvinprabhu added 2 commits October 22, 2026 14:42

kelvinprabhu commented Oct 22, 2026

View reviewed changes

fix: add deprecation notice for unmaintained openpgp package in .triv…

54a0ffb

…yignore

kelvinprabhu requested a review from manjudr October 22, 2026 09:29

kelvinprabhu changed the base branch from development to main October 23, 2026 05:13

kelvinprabhu changed the base branch from main to development October 23, 2026 05:14

kelvinprabhu commented Oct 23, 2026

View reviewed changes

Comment thread .trivyignore Outdated

docs: shorten the GO-2026-5932 note in .trivyignore [#85]

4bb7b7e

Cut the openpgp explanation down to two lines, per review.

manjudr approved these changes Oct 23, 2026

View reviewed changes

manjudr merged commit c071d6b into development Oct 23, 2026
4 checks passed

manjudr deleted the feat/85-fix-the-open-security-and-vulnerability-findings branch October 23, 2026 09:32

Navigation Menu

Repository navigation

Feat/85 fix the open security and vulnerability findings - #88

Feat/85 fix the open security and vulnerability findings#88
manjudr merged 7 commits into
developmentfrom
feat/85-fix-the-open-security-and-vulnerability-findings

kelvinprabhu commented Oct 22, 2026

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 22, 2026 •

edited

Loading

Uh oh!

manjudr commented Oct 22, 2026

Uh oh!

Uh oh!

manjudr commented Oct 22, 2026

Uh oh!

kelvinprabhu left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kelvinprabhu commented Oct 22, 2026

Summary

Fixed in this PR

github.com/getkin/kin-openapi v0.144.0 → v0.149.0 — dd39ce04

Alert #47 — go/zipslip (CWE-22), pkg/plugin/manager.go — 1f559223,

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ Trivy security scan (CRITICAL,HIGH,MEDIUM,LOW)

Go dependencies

Container image

Uh oh!

github-actions Bot commented Oct 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

manjudr commented Oct 22, 2026

Uh oh!

Uh oh!

manjudr commented Oct 22, 2026

Uh oh!

kelvinprabhu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

`github.com/getkin/kin-openapi` v0.144.0 → v0.149.0 — `dd39ce04`

Alert #47 — `go/zipslip` (CWE-22), `pkg/plugin/manager.go` — `1f559223`,

github-actions Bot commented Oct 22, 2026 •

edited

Loading

github-actions Bot commented Oct 22, 2026 •

edited

Loading