Lint

Author: nikita-unity

docs/enterprise-features.json

@@ -16,7 +16,8 @@
         "snow-query-for-records",
         "snow-wait-for-condition",
         "toml-parse",
-        "toml-update"
+        "toml-update",
+        "kcl-run"
     ],
     "pro": [
         "jira",

pkg/promotion/runner/builtin/kcl_run.go

@@ -274,7 +274,7 @@ func (k *kclRunner) writeOutput(
 
 func pathLooksLikeFile(path string) bool {
 	ext := filepath.Ext(path)
-	return ext == ".yaml" || ext == ".yml"
+	return ext == ".yaml" || ext == ".yml" //nolint:goconst
 }
 
 func writeManifestDirectory(
@@ -314,7 +314,13 @@ func writeManifestDirectory(
 				fallbackIndex++
 			}
 
-			if err = os.WriteFile(filepath.Join(outPath, fileName), resource, 0o600); err != nil {
+			outputPath, err := safeOutputResourcePath(outPath, fileName)
+			if err != nil {
+				return err
+			}
+
+			//nolint:gosec // outputPath is constrained to outPath by basename validation and securejoin
+			if err = os.WriteFile(outputPath, resource, 0o600); err != nil {
 				return fmt.Errorf("failed to write resource to file %q: %w", fileName, err)
 			}
 		}
@@ -323,6 +329,26 @@ func writeManifestDirectory(
 	return nil
 }
 
+func safeOutputResourcePath(outPath string, fileName string) (string, error) {
+	cleanName := filepath.Clean(fileName)
+	if cleanName == "." || cleanName == ".." {
+		return "", fmt.Errorf("invalid resource file name %q", fileName)
+	}
+	if filepath.IsAbs(cleanName) {
+		return "", fmt.Errorf("resource file name %q must be relative", fileName)
+	}
+	if cleanName != filepath.Base(cleanName) {
+		return "", fmt.Errorf("resource file name %q must not contain path separators", fileName)
+	}
+
+	joinedPath, err := securejoin.SecureJoin(outPath, cleanName)
+	if err != nil {
+		return "", fmt.Errorf("failed to build output path for %q: %w", fileName, err)
+	}
+
+	return joinedPath, nil
+}
+
 func splitManifestResources(document []byte) ([][]byte, error) {
 	var value any
 	if err := libyaml.Unmarshal(document, &value); err != nil {

pkg/promotion/runner/builtin/kcl_run_test.go

@@ -230,7 +230,25 @@ app = {
     }
 }
 `), 0o600))
-				require.NoError(t, os.WriteFile(filepath.Join(dir, "app", "kcl.yaml"), []byte("kcl_cli_configs:\n  file:\n    - main.k\n\nkcl_options:\n  - key: app-name\n    value: demo\n  - key: namespace\n    value: prod\n  - key: version\n    value: \"v1.2.3\"\n"), 0o600))
+				require.NoError(
+					t,
+					os.WriteFile(
+						filepath.Join(dir, "app", "kcl.yaml"),
+						[]byte(`kcl_cli_configs:
+	file:
+		- main.k
+
+kcl_options:
+	- key: app-name
+		value: demo
+	- key: namespace
+		value: prod
+	- key: version
+		value: "v1.2.3"
+`),
+						0o600,
+					),
+				)
 			},
 			config: configbuiltin.KCLRunConfig{
 				Path:    "./app/kcl.yaml",