Safe filenames

README.md

@@ -1566,6 +1566,8 @@ validate threshold            Validate the compliance and status counts of an HD
 
 ### Generate
 
+NOTE: Please be aware that the `delta` and `update_controls4delta` subcommands can invoke an InSpec or CINC Auditor executable supplied through the -I/--inspecPath flag.  Untrusted executable paths or arguments can create a command injection risk.  Furthermore, Windows requires this invocation to use a shell which can create a risk of shell injection.  The SAF CLI has been hardened so as to reduce these risks; however, as a workaround, run InSpec or CINC Auditor manually to generate the profile JSON, then provide it with the -J/--inspecJsonFile flag.
+
 #### Delta
 
 Update an existing InSpec profile with new or updated XCCDF guidance. With -M (runMapControls), uses a 3-tier SRG/CCI requirement-first matcher for cross-vendor deltas (e.g. RHEL 9 → Amazon Linux 2023) and persists per-control match decisions into delta.json's links[] field.

package.json

@@ -62,6 +62,7 @@
     "open": "^11.0.0",
     "prompt-sync": "^4.2.0",
     "run-script-os": "^1.1.6",
+    "sanitize-filename": "^1.6.4",
     "table": "^6.8.1",
     "tmp": "^0.2.1",
     "tsimportlib": "^0.0.5",

src/commands/attest/apply.ts

@@ -1,11 +1,10 @@
 import fs from 'fs';
-import path from 'path';
 import { Flags } from '@oclif/core';
 import _ from 'lodash';
 import type { ExecJSON } from 'inspecjs';
 import { addAttestationToHDF, parseXLSXAttestations, type Attestation } from '@mitre/hdf-converters';
 import yaml from 'yaml';
-import { basename } from '../../utils/global';
+import { basename, resolveSafeChild, safeFilename } from '../../utils/global';
 import { BaseCommand } from '../../utils/oclif/base_command';
 
 export default class ApplyAttestation extends BaseCommand<typeof ApplyAttestation> {
@@ -74,7 +73,7 @@ export default class ApplyAttestation extends BaseCommand<typeof ApplyAttestatio
       if (Object.entries(executions).length <= 1) {
         fs.writeFileSync(flags.output, JSON.stringify(applied, null, 2));
       } else {
-        fs.writeFileSync(path.join(flags.output, originalFilename), JSON.stringify(applied, null, 2));
+        fs.writeFileSync(resolveSafeChild(flags.output, safeFilename(originalFilename)), JSON.stringify(applied, null, 2));
       }
     }
   }

src/commands/convert/asff2hdf.ts

@@ -1,5 +1,4 @@
 import fs from 'fs';
-import path from 'path';
 import {
   type AwsSecurityFindingFilters,
   type DescribeStandardsControlsCommandOutput,
@@ -14,7 +13,7 @@ import { ASFFResults as Mapper, INPUT_TYPES } from '@mitre/hdf-converters';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import https from 'https';
 import _ from 'lodash';
-import { basename, checkInput, checkSuffix } from '../../utils/global';
+import { checkInput, checkSuffix, resolveSafeChild, safeFilename } from '../../utils/global';
 import { createWinstonLogger } from '../../utils/logging';
 import { BaseCommand } from '../../utils/oclif/base_command';
 
@@ -289,7 +288,7 @@ export default class ASFF2HDF extends BaseCommand<typeof ASFF2HDF> {
     fs.mkdirSync(flags.output);
     _.forOwn(results, (result, filename) => {
       fs.writeFileSync(
-        path.join(flags.output, checkSuffix(basename(filename))),
+        resolveSafeChild(flags.output, safeFilename(checkSuffix(filename))),
         JSON.stringify(result, null, 2),
       );
     });

src/commands/convert/ckl2poam.ts

@@ -1,5 +1,4 @@
 import { mkdir, readFile } from 'fs/promises';
-import path from 'path';
 import { Flags } from '@oclif/core';
 import { XMLParser } from 'fast-xml-parser';
 import _ from 'lodash';
@@ -23,7 +22,7 @@ import {
   extractSTIGUrl,
   replaceSpecialCharacters,
 } from '../../utils/ckl2poam';
-import { basename, dataURLtoU8Array } from '../../utils/global';
+import { basename, dataURLtoU8Array, resolveSafeChild, safeFilename } from '../../utils/global';
 import { createWinstonLogger } from '../../utils/logging';
 import { BaseCommand } from '../../utils/oclif/base_command';
 
@@ -318,7 +317,7 @@ export default class CKL2POAM extends BaseCommand<typeof CKL2POAM> {
           currentRow += flags.rowsToSkip + 1;
         }
       }
-      return workBook.toFileAsync(path.join(flags.output, `${basename(fileName)}-${moment(new Date()).format('YYYY-MM-DD-HHmm')}.xlsm`));
+      return workBook.toFileAsync(resolveSafeChild(flags.output, safeFilename(`${basename(fileName)}-${moment(new Date()).format('YYYY-MM-DD-HHmm')}.xlsm`)));
     }));
   }
 }

src/commands/convert/conveyor2hdf.ts

@@ -1,8 +1,7 @@
 import { Flags } from '@oclif/core';
 import fs from 'fs';
 import { ConveyorResults as Mapper, INPUT_TYPES } from '@mitre/hdf-converters';
-import { basename, checkInput, checkSuffix } from '../../utils/global';
-import path from 'path';
+import { checkInput, checkSuffix, resolveSafeChild, safeFilename } from '../../utils/global';
 import { BaseCommand } from '../../utils/oclif/base_command';
 export default class Conveyor2HDF extends BaseCommand<typeof Conveyor2HDF> {
   static readonly usage
@@ -38,7 +37,7 @@ export default class Conveyor2HDF extends BaseCommand<typeof Conveyor2HDF> {
     fs.mkdirSync(flags.output);
     for (const [filename, result] of Object.entries(results)) {
       fs.writeFileSync(
-        path.join(flags.output, checkSuffix(basename(filename))),
+        resolveSafeChild(flags.output, safeFilename(checkSuffix(filename))),
         JSON.stringify(result, null, 2),
       );
     }

src/commands/convert/hdf2asff.ts

@@ -1,6 +1,5 @@
 import fs from 'fs';
 import https from 'https';
-import path from 'path';
 import {
   type AwsSecurityFinding,
   SecurityHub,
@@ -10,7 +9,7 @@ import { FromHdfToAsffMapper as Mapper } from '@mitre/hdf-converters';
 import { Flags } from '@oclif/core';
 import { NodeHttpHandler } from '@smithy/node-http-handler';
 import _ from 'lodash';
-import { basename, checkSuffix } from '../../utils/global';
+import { basename, checkSuffix, resolveSafeChild, safeFilename } from '../../utils/global';
 import { BaseCommand } from '../../utils/oclif/base_command';
 
 export default class HDF2ASFF extends BaseCommand<typeof HDF2ASFF> {
@@ -104,19 +103,19 @@ export default class HDF2ASFF extends BaseCommand<typeof HDF2ASFF> {
       const outputFolder = flags.output.replace('.json', '') || 'asff-output';
       fs.mkdirSync(outputFolder);
       if (convertedSlices.length === 1) {
-        const outfilePath = path.join(
+        const outfilePath = resolveSafeChild(
           outputFolder,
-          checkSuffix(basename(flags.output)),
+          safeFilename(checkSuffix(flags.output)),
         );
         fs.writeFileSync(
           outfilePath,
           JSON.stringify(convertedSlices[0], null, 2),
         );
       } else {
         for (const [index, slice] of convertedSlices.entries()) {
-          const outfilePath = path.join(
+          const outfilePath = resolveSafeChild(
             outputFolder,
-            `${checkSuffix(basename(flags.output || '')).replace('.json', '')}.p${index}.json`,
+            safeFilename(`${checkSuffix(basename(flags.output || '')).replace('.json', '')}.p${index}.json`),
           );
           fs.writeFileSync(outfilePath, JSON.stringify(slice, null, 2));
         }

src/commands/convert/hdf2csv.ts

@@ -9,7 +9,7 @@ import _ from 'lodash';
 import type { Logger } from 'winston';
 import type { ControlSetRows } from '../../types/csv';
 import { convertRow, csvExportFields } from '../../utils/csv';
-import { basename } from '../../utils/global';
+import { basename, resolveSafeChild, safeFilename } from '../../utils/global';
 import { createWinstonLogger } from '../../utils/logging';
 import { BaseCommand } from '../../utils/oclif/base_command';
 
@@ -86,7 +86,7 @@ export default class HDF2CSV extends BaseCommand<typeof HDF2CSV> {
     if (flags.interactive) {
       const interactiveFlags = await this.getFlags();
       inputFile = interactiveFlags.inputFile;
-      outputFile = path.join(interactiveFlags.outputDirectory, interactiveFlags.outputFileName);
+      outputFile = resolveSafeChild(interactiveFlags.outputDirectory, safeFilename(interactiveFlags.outputFileName));
       includeFields = interactiveFlags.fields.join(',');
       truncateFields = Boolean(interactiveFlags.truncateFields);
     } else if (this.requiredFlagsProvided(flags)) {

src/commands/convert/hdf2html.ts

@@ -1,7 +1,7 @@
 import fs from 'fs';
-import path from 'path';
 import { FileExportTypes, FromHDFToHTMLMapper as Mapper } from '@mitre/hdf-converters';
 import { Command, Flags } from '@oclif/core';
+import { basename } from '../../utils/global';
 
 export default class HDF2HTML extends Command {
   static readonly usage = 'convert hdf2html -i <hdf-scan-results-json>... -o <output-html> [-t <output-type>] [-h]';
@@ -22,7 +22,7 @@ export default class HDF2HTML extends Command {
   async run() {
     const { flags } = await this.parse(HDF2HTML);
 
-    const files = flags.input.map((file, i) => ({ data: fs.readFileSync(file, 'utf8'), fileName: path.basename(file), fileID: `${i}` }));
+    const files = flags.input.map((file, i) => ({ data: fs.readFileSync(file, 'utf8'), fileName: basename(file), fileID: `${i}` }));
 
     const converter = await new Mapper(files, FileExportTypes[flags.type as keyof typeof FileExportTypes]).toHTML();
     fs.writeFileSync(flags.output, converter);

src/commands/convert/index.ts

@@ -29,7 +29,7 @@ import {
   ZapMapper,
 } from '@mitre/hdf-converters';
 import { Flags } from '@oclif/core';
-import { basename, checkSuffix } from '../../utils/global';
+import { basename, checkSuffix, resolveSafeChild, safeFilename } from '../../utils/global';
 import { BaseCommand } from '../../utils/oclif/base_command';
 import ASFF2HDF from './asff2hdf';
 import Zap2HDF from './zap2hdf';
@@ -75,7 +75,7 @@ export default class Convert extends BaseCommand<typeof Convert> {
         filename: basename(filePath),
       });
       switch (
-        Convert.detectedType // skipcq: JS-0047
+        Convert.detectedType
       ) {
         case 'asff': {
           return ASFF2HDF.flags;
@@ -130,7 +130,7 @@ export default class Convert extends BaseCommand<typeof Convert> {
         fs.mkdirSync(flags.output);
         _.forOwn(results, (result, filename) => {
           fs.writeFileSync(
-            path.join(flags.output, checkSuffix(basename(filename))),
+            resolveSafeChild(flags.output, safeFilename(checkSuffix(filename))),
             JSON.stringify(result, null, 2),
           );
         });
@@ -161,7 +161,7 @@ export default class Convert extends BaseCommand<typeof Convert> {
         fs.mkdirSync(flags.output);
         for (const [filename, result] of Object.entries(results)) {
           fs.writeFileSync(
-            path.join(flags.output, checkSuffix(basename(filename))),
+            resolveSafeChild(flags.output, safeFilename(checkSuffix(filename))),
             JSON.stringify(result, null, 2),
           );
         }
@@ -241,9 +241,11 @@ export default class Convert extends BaseCommand<typeof Convert> {
         const result = converter.toHdf();
         const pluralResults = Array.isArray(result) ? result : [];
         const singularResult = pluralResults.length === 0;
+        const outputBase = path.dirname(flags.output);
+        const outputPrefix = safeFilename(flags.output.replaceAll(/\.json/gi, ''));
         for (const element of pluralResults) {
           fs.writeFileSync(
-            `${flags.output.replaceAll(/\.json/gi, '')}-${basename(_.get(element, 'platform.target_id') || '')}.json`,
+            resolveSafeChild(outputBase, safeFilename(`${outputPrefix}-${basename(_.get(element, 'platform.target_id') || '')}.json`)),
             JSON.stringify(element, null, 2),
           );
         }
@@ -294,9 +296,9 @@ export default class Convert extends BaseCommand<typeof Convert> {
         fs.mkdirSync(flags.output);
         _.forOwn(results, (result) => {
           fs.writeFileSync(
-            path.join(
+            resolveSafeChild(
               flags.output,
-              basename(`${_.get(result, 'platform.target_id')}.json`),
+              safeFilename(`${_.get(result, 'platform.target_id')}.json`),
             ),
             JSON.stringify(result, null, 2),
           );
@@ -327,9 +329,11 @@ export default class Convert extends BaseCommand<typeof Convert> {
         const result = converter.toHdf();
         const pluralResults = Array.isArray(result) ? result : [];
         const singularResult = pluralResults.length === 0;
+        const outputBase = path.dirname(flags.output);
+        const outputPrefix = safeFilename(flags.output.replaceAll(/\.json/gi, ''));
         for (const element of pluralResults) {
           fs.writeFileSync(
-            `${flags.output.replaceAll(/\.json/gi, '')}-${basename(_.get(element, 'platform.target_id') || '')}.json`,
+            resolveSafeChild(outputBase, safeFilename(`${outputPrefix}-${basename(_.get(element, 'platform.target_id') || '')}.json`)),
             JSON.stringify(element, null, 2),
           );
         }