Merge pull request #2167 from ksylvan/fix/pattern-path-traversal-2123-re-created

fix: block path traversal in pattern name lookup (closes #2094)

cmd/generate_changelog/incoming/2167.txt

@@ -0,0 +1,4 @@
+### PR [#2123](https://github.com/danielmiessler/Fabric/pull/2123) by [ksylvan](https://github.com/ksylvan) and [OdinKral](https://github.com/OdinKral): fix: block path traversal in pattern name lookup
+
+- **Security Fix:** Blocked path traversal attacks in pattern name lookup (closes #2094) — pattern names containing `..` could previously escape the patterns directory and read arbitrary files via `filepath.Join`; a guard has been added at the top of `getFromDB`, an i18n key `pattern_invalid_name` has been added to all 11 locale files, and test cases now cover all common traversal variants.
+- New translations for the "invalid pattern" user-facing string.

internal/i18n/locales/de.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Video-Metadaten ausgeben",
   "path_to_yaml_config": "Pfad zur YAML-Konfigurationsdatei",
   "pattern_not_found_list_available": "Pattern '%s' nicht gefunden. Führen Sie 'fabric -l' aus, um verfügbare Patterns anzuzeigen",
+  "pattern_invalid_name": "Ungültiger Pattern-Name: %q",
   "pattern_not_found_no_patterns": "Pattern '%s' nicht gefunden.\n\nKeine Patterns installiert! Um dies zu beheben:\n  • Führen Sie 'fabric --setup' aus, um Patterns zu konfigurieren und herunterzuladen\n  • Oder führen Sie 'fabric -U' aus, um Patterns direkt herunterzuladen/zu aktualisieren",
   "pattern_variables_help": "Werte für Mustervariablen, z.B. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Repository %s wird geklont (Pfad: %s)...\\n",

internal/i18n/locales/en.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Output video metadata",
   "path_to_yaml_config": "Path to YAML config file",
   "pattern_not_found_list_available": "pattern '%s' not found. Run 'fabric -l' to see available patterns",
+  "pattern_invalid_name": "invalid pattern name: %q",
   "pattern_not_found_no_patterns": "pattern '%s' not found.\n\nNo patterns are installed! To fix this:\n  • Run 'fabric --setup' to configure and download patterns\n  • Or run 'fabric -U' to download/update patterns directly",
   "pattern_variables_help": "Values for pattern variables, e.g. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Cloning repository %s (path: %s)...\n",

internal/i18n/locales/es.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Salida de metadatos del video",
   "path_to_yaml_config": "Ruta al archivo de configuración YAML",
   "pattern_not_found_list_available": "patrón '%s' no encontrado. Ejecuta 'fabric -l' para ver los patrones disponibles",
+  "pattern_invalid_name": "nombre de patrón inválido: %q",
   "pattern_not_found_no_patterns": "patrón '%s' no encontrado.\n\n¡No hay patrones instalados! Para solucionar esto:\n  • Ejecuta 'fabric --setup' para configurar y descargar patrones\n  • O ejecuta 'fabric -U' para descargar/actualizar patrones directamente",
   "pattern_variables_help": "Valores para variables de patrón, ej. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando el repositorio %s (ruta: %s)...\\n",

internal/i18n/locales/fa.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "نمایش فراداده ویدیو",
   "path_to_yaml_config": "مسیر فایل پیکربندی YAML",
   "pattern_not_found_list_available": "الگوی '%s' یافت نشد. برای مشاهده الگوهای موجود 'fabric -l' را اجرا کنید",
+  "pattern_invalid_name": "نام الگوی نامعتبر: %q",
   "pattern_not_found_no_patterns": "الگوی '%s' یافت نشد.\n\nهیچ الگویی نصب نشده است! برای رفع این مشکل:\n  • 'fabric --setup' را برای پیکربندی و دانلود الگوها اجرا کنید\n  • یا 'fabric -U' را برای دانلود/به‌روزرسانی الگوها اجرا کنید",
   "pattern_variables_help": "مقادیر برای متغیرهای الگو، مثال: -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "در حال کلون کردن مخزن %s (مسیر: %s)...\\n",

internal/i18n/locales/fr.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Afficher les métadonnées de la vidéo",
   "path_to_yaml_config": "Chemin vers le fichier de configuration YAML",
   "pattern_not_found_list_available": "modèle '%s' non trouvé. Exécutez 'fabric -l' pour voir les modèles disponibles",
+  "pattern_invalid_name": "nom de modèle invalide : %q",
   "pattern_not_found_no_patterns": "modèle '%s' non trouvé.\n\nAucun modèle n'est installé ! Pour résoudre ce problème :\n  • Exécutez 'fabric --setup' pour configurer et télécharger les modèles\n  • Ou exécutez 'fabric -U' pour télécharger/mettre à jour les modèles directement",
   "pattern_variables_help": "Valeurs pour les variables de motif, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonage du dépôt %s (chemin : %s)...\\n",

internal/i18n/locales/it.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Output metadati video",
   "path_to_yaml_config": "Percorso del file di configurazione YAML",
   "pattern_not_found_list_available": "pattern '%s' non trovato. Esegui 'fabric -l' per vedere i pattern disponibili",
+  "pattern_invalid_name": "nome pattern non valido: %q",
   "pattern_not_found_no_patterns": "pattern '%s' non trovato.\n\nNessun pattern installato! Per risolvere:\n  • Esegui 'fabric --setup' per configurare e scaricare i pattern\n  • Oppure esegui 'fabric -U' per scaricare/aggiornare i pattern direttamente",
   "pattern_variables_help": "Valori per le variabili pattern, es. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonazione del repository %s (percorso: %s)...\\n",

internal/i18n/locales/ja.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "動画メタデータを出力",
   "path_to_yaml_config": "YAML設定ファイルのパス",
   "pattern_not_found_list_available": "パターン '%s' が見つかりません。'fabric -l'で利用可能なパターンを確認してください",
+  "pattern_invalid_name": "無効なパターン名: %q",
   "pattern_not_found_no_patterns": "パターン '%s' が見つかりません。\n\nパターンがインストールされていません！解決するには:\n  • 'fabric --setup'を実行してパターンを設定・ダウンロード\n  • または'fabric -U'を実行してパターンをダウンロード/更新",
   "pattern_variables_help": "パターン変数の値、例：-v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "リポジトリ %s をクローン中 (パス: %s)...\\n",

internal/i18n/locales/pl.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Wyprowadź metadane wideo",
   "path_to_yaml_config": "Ścieżka do pliku konfiguracyjnego YAML",
   "pattern_not_found_list_available": "wzorzec '%s' nie został znaleziony. Uruchom 'fabric -l', aby zobaczyć dostępne wzorce",
+  "pattern_invalid_name": "nieprawidłowa nazwa wzorca: %q",
   "pattern_not_found_no_patterns": "wzorzec '%s' nie został znaleziony.\n\nNie zainstalowano żadnych wzorców! Aby to naprawić:\n  • Uruchom 'fabric --setup', aby skonfigurować i pobrać wzorce\n  • Lub uruchom 'fabric -U', aby bezpośrednio pobrać/zaktualizować wzorce",
   "pattern_variables_help": "Wartości dla zmiennych wzorców, np. -v=#role:ekspert -v=#points:30",
   "patterns_cloning_repository": "Klonowanie repozytorium %s (ścieżka: %s)...\n",

internal/i18n/locales/pt-BR.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Exibir metadados do vídeo",
   "path_to_yaml_config": "Caminho para arquivo de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
+  "pattern_invalid_name": "nome de padrão inválido: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e baixar padrões\n  • Ou execute 'fabric -U' para baixar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis do padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "Clonando repositório %s (caminho: %s)...\\n",

internal/i18n/locales/pt-PT.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "Mostrar metadados do vídeo",
   "path_to_yaml_config": "Caminho para ficheiro de configuração YAML",
   "pattern_not_found_list_available": "padrão '%s' não encontrado. Execute 'fabric -l' para ver os padrões disponíveis",
+  "pattern_invalid_name": "nome de padrão inválido: %q",
   "pattern_not_found_no_patterns": "padrão '%s' não encontrado.\n\nNenhum padrão instalado! Para resolver:\n  • Execute 'fabric --setup' para configurar e descarregar padrões\n  • Ou execute 'fabric -U' para descarregar/atualizar padrões diretamente",
   "pattern_variables_help": "Valores para variáveis de padrão, ex. -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "A clonar repositório %s (caminho: %s)...\\n",

internal/i18n/locales/zh.json

@@ -418,6 +418,7 @@
   "output_video_metadata": "输出视频元数据",
   "path_to_yaml_config": "YAML 配置文件路径",
   "pattern_not_found_list_available": "未找到模式 '%s'。运行 'fabric -l' 查看可用模式",
+  "pattern_invalid_name": "无效的模式名称：%q",
   "pattern_not_found_no_patterns": "未找到模式 '%s'。\n\n未安装任何模式！要解决此问题：\n  • 运行 'fabric --setup' 配置并下载模式\n  • 或运行 'fabric -U' 直接下载/更新模式",
   "pattern_variables_help": "模式变量的值，例如 -v=#role:expert -v=#points:30",
   "patterns_cloning_repository": "正在克隆仓库 %s（至路径：%s）...\\n",

internal/plugins/db/fsdb/patterns.go

@@ -119,6 +119,10 @@ func (o *PatternsEntity) applyVariables(
 
 // retrieves a pattern from the database by name
 func (o *PatternsEntity) getFromDB(name string) (ret *Pattern, err error) {
+	if strings.Contains(name, "..") {
+		return nil, fmt.Errorf(i18n.T("pattern_invalid_name"), name)
+	}
+
 	// First check custom patterns directory if it exists
 	if o.CustomPatternsDir != "" {
 		customPatternPath := filepath.Join(o.CustomPatternsDir, name, o.SystemPatternFile)

internal/plugins/db/fsdb/patterns_test.go

@@ -332,6 +332,24 @@ func TestPrintPattern(t *testing.T) {
 	})
 }
 
+func TestGetFromDB_PathTraversal(t *testing.T) {
+	entity, cleanup := setupTestPatternsEntity(t)
+	defer cleanup()
+
+	traversalNames := []string{
+		"../etc/passwd",
+		"../../secret",
+		"foo/../bar",
+		"..",
+		"valid/../../../etc/shadow",
+	}
+	for _, name := range traversalNames {
+		_, err := entity.GetRaw(name)
+		assert.Error(t, err, "expected error for traversal name: %q", name)
+		assert.Contains(t, err.Error(), "invalid pattern name", "wrong error for: %q", name)
+	}
+}
+
 func TestPatternsEntity_CustomPatternsEmpty(t *testing.T) {
 	// Test behavior when custom patterns directory is empty or doesn't exist
 	mainDir, err := os.MkdirTemp("", "test-main-patterns-*")