Unvalidated RALPHRC_FILE path allows sourcing arbitrary files #78
Description
Severity: HIGH
Location
ralph/ralph_loop.sh:102,110-121,152
Description
RALPHRC_FILE can be overridden via environment with no validation. An attacker who can set env vars (CI pipeline, docker-compose, wrapper script) can point it at any bash file on the system, which then gets executed via source.
Suggested fix
Validate the resolved path is within the project directory before sourcing.