From dcaadd4857ece9910cdc933453ec9c7cc17d0adb Mon Sep 17 00:00:00 2001 From: MHSanaei Date: Sat, 26 Sep 2026 12:40:31 +0200 Subject: [PATCH] fix(panel): validate sponsor logo name before any file or network use The public /sponsors/logo/:name route only accepted names matching an active sponsor's logo, which was already regex-filtered, but that guard was indirect. Checking sponsorLogoRe on the name itself makes the path/URL safety local and clears CodeQL alerts #113 (go/request-forgery) and #114 (go/path-injection). --- internal/web/service/panel/sponsor.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/internal/web/service/panel/sponsor.go b/internal/web/service/panel/sponsor.go index 282d42f48..0bc564339 100644 --- a/internal/web/service/panel/sponsor.go +++ b/internal/web/service/panel/sponsor.go @@ -110,6 +110,10 @@ func cachedSponsors() (*SponsorList, error) { // GetSponsorLogo returns the image bytes for a logo of a currently active sponsor. func (s *PanelService) GetSponsorLogo(name string) ([]byte, string, error) { + // Validated here, not only via list membership, so name can never carry a path or URL. + if !sponsorLogoRe.MatchString(name) { + return nil, "", ErrSponsorLogoUnknown + } sponsors, err := s.GetSponsors() if err != nil { return nil, "", err