Mathis/llamactl
1
0
Fork 0
mirror of https://github.com/lordmathis/llamactl.git synced 2025-11-05 16:44:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Re-validate instance name in DeleteInstance for improved security

Browse Source
This commit is contained in:
Matúš Námešný
2025-10-09 22:18:53 +02:00
parent 5436c28a1f
commit 9ee0a184b3
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
pkg/manager/operations.go
View File

@@ -288,12 +288,13 @@ func (im *instanceManager) DeleteInstance(name string) error {
// Delete the instance's config file if persistence is enabled
// Re-validate instance name for security (defense in depth)
if _, err := validation.ValidateInstanceName(name); err != nil {
validatedName, err := validation.ValidateInstanceName(name)
if err != nil {
return fmt.Errorf("invalid instance name for file deletion: %w", err)
}
instancePath := filepath.Join(im.instancesConfig.InstancesDir, name+".json")
instancePath := filepath.Join(im.instancesConfig.InstancesDir, validatedName+".json")
if err := os.Remove(instancePath); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("failed to delete config file for remote instance %s: %w", name, err)
return fmt.Errorf("failed to delete config file for remote instance %s: %w", validatedName, err)
}
return nil
@@ -311,12 +312,13 @@ func (im *instanceManager) DeleteInstance(name string) error {
// Delete the instance's config file if persistence is enabled
// Re-validate instance name for security (defense in depth)
if _, err := validation.ValidateInstanceName(inst.Name); err != nil {
validatedName, err := validation.ValidateInstanceName(inst.Name)
if err != nil {
return fmt.Errorf("invalid instance name for file deletion: %w", err)
}
instancePath := filepath.Join(im.instancesConfig.InstancesDir, inst.Name+".json")
instancePath := filepath.Join(im.instancesConfig.InstancesDir, validatedName+".json")
if err := os.Remove(instancePath); err != nil && !os.IsNotExist(err) {
return fmt.Errorf("failed to delete config file for instance %s: %w", inst.Name, err)
return fmt.Errorf("failed to delete config file for instance %s: %w", validatedName, err)
}
return nil