@@ -64,30 +64,15 @@ func deleteContents(dir string) error {
6464 return err
6565 }
6666 for _ , f := range files {
67- // Sanitize the filename to prevent path traversal attacks
68- fileName := f .Name ()
69- if strings .Contains (fileName , ".." ) || strings .Contains (fileName , "/" ) || strings .Contains (fileName , "\\ " ) {
70- klog .V (4 ).Infof ("Skipping potentially malicious filename: %s" , fileName )
71- continue
72- }
73-
74- // Ensure the resolved path is still within the target directory
75- targetPath := filepath .Join (dir , fileName )
76- cleanPath := filepath .Clean (targetPath )
77- if ! strings .HasPrefix (cleanPath , filepath .Clean (dir )+ string (filepath .Separator )) && cleanPath != filepath .Clean (dir ) {
78- klog .V (4 ).Infof ("Skipping path traversal attempt: %s" , fileName )
79- continue
80- }
81-
8267 if f .IsDir () {
83- klog .V (5 ).Infof ("Deleting directory: %s" , fileName )
84- err = os .RemoveAll (cleanPath )
68+ klog .V (5 ).Infof ("Deleting directory: %s" , f . Name () )
69+ err = os .RemoveAll (filepath . Clean ( filepath . Join ( dir , f . Name ())) )
8570 } else {
86- klog .V (5 ).Infof ("Deleting file: %s" , fileName )
87- err = os .Remove (cleanPath )
71+ klog .V (5 ).Infof ("Deleting file: %s" , f . Name () )
72+ err = os .Remove (filepath . Clean ( filepath . Join ( dir , f . Name ())) )
8873 }
8974 if err != nil {
90- klog .V (4 ).Infof ("Error deleting file or directory: %s: %v" , fileName , err )
75+ klog .V (4 ).Infof ("Error deleting file or directory: %s: %v" , f . Name () , err )
9176 return err
9277 }
9378 }
0 commit comments