Mathis/llamactl
1
0
Fork 0
mirror of https://github.com/lordmathis/llamactl.git synced 2025-11-05 16:44:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add instance name validation before deletion for security

Browse Source
This commit is contained in:
Matúš Námešný
2025-10-09 22:10:40 +02:00
parent 73b9dd5bc7
commit 5436c28a1f
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/manager/operations.go
View File

@@ -287,6 +287,10 @@ func (im *instanceManager) DeleteInstance(name string) error {
delete(im.instanceNodeMap, name)
// Delete the instance's config file if persistence is enabled
// Re-validate instance name for security (defense in depth)
if _, err := validation.ValidateInstanceName(name); err != nil {
return fmt.Errorf("invalid instance name for file deletion: %w", err)
}
instancePath := filepath.Join(im.instancesConfig.InstancesDir, name+".json")
if err := os.Remove(instancePath); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("failed to delete config file for remote instance %s: %w", name, err)
@@ -306,6 +310,10 @@ func (im *instanceManager) DeleteInstance(name string) error {
delete(im.instances, name)
// Delete the instance's config file if persistence is enabled
// Re-validate instance name for security (defense in depth)
if _, err := validation.ValidateInstanceName(inst.Name); err != nil {
return fmt.Errorf("invalid instance name for file deletion: %w", err)
}
instancePath := filepath.Join(im.instancesConfig.InstancesDir, inst.Name+".json")
if err := os.Remove(instancePath); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("failed to delete config file for instance %s: %w", inst.Name, err)