ceph: Fixing the potential file inclusion error

This commit is also part of gosec error handling which handles the following issue:

Fixed G304: Potential File inclusion by cleaning up the file path

Signed-off-by: Nizamudeen <nia@redhat.com>

pkg/daemon/ceph/agent/flexvolume/server.go

@@ -27,6 +27,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
@@ -173,7 +174,7 @@ func LoadFlexSettings(directory string) []byte {
 	// Load the settings from the expected config file, ensure they are valid settings, then return them in
 	// a json string to the caller
 	var status flexvolume.DriverStatus
-	if output, err := ioutil.ReadFile(path.Join(directory, settingsFilename)); err == nil {
+	if output, err := ioutil.ReadFile(filepath.Clean(path.Join(directory, settingsFilename))); err == nil {
 		if err := json.Unmarshal(output, &status); err == nil {
 			if output, err = json.Marshal(status); err == nil {
 				return output
@@ -246,7 +247,7 @@ func configureFlexVolume(driverFile, driverDir, driverName string) error {
 }
 
 func copyFile(src, dest string) error {
-	srcFile, err := os.Open(src)
+	srcFile, err := os.Open(filepath.Clean(src))
 	if err != nil {
 		return errors.Wrapf(err, "error opening source file %s", src)
 	}

pkg/daemon/ceph/osd/daemon.go

@@ -158,7 +158,7 @@ func Provision(context *clusterd.Context, agent *OsdAgent, crushLocation string)
 	if err != nil {
 		return errors.Wrapf(err, "failed to write connection config")
 	}
-	src, err := ioutil.ReadFile(confFilePath)
+	src, err := ioutil.ReadFile(filepath.Clean(confFilePath))
 	if err != nil {
 		return errors.Wrapf(err, "failed to copy connection config to /etc/ceph. failed to read the connection config")
 	}

pkg/daemon/ceph/util/util.go

@@ -51,10 +51,10 @@ func FindRBDMappedFile(imageName, poolName, sysBusDir string) (string, error) {
 	}
 
 	for _, idFile := range files {
-		nameContent, err := ioutil.ReadFile(filepath.Join(sysBusDeviceDir, idFile.Name(), "name"))
+		nameContent, err := ioutil.ReadFile(filepath.Clean(filepath.Join(sysBusDeviceDir, idFile.Name(), "name")))
 		if err == nil && imageName == strings.TrimSpace(string(nameContent)) {
 			// the image for the current rbd device matches, now try to match pool
-			poolContent, err := ioutil.ReadFile(filepath.Join(sysBusDeviceDir, idFile.Name(), "pool"))
+			poolContent, err := ioutil.ReadFile(filepath.Clean(filepath.Join(sysBusDeviceDir, idFile.Name(), "pool")))
 			if err == nil && poolName == strings.TrimSpace(string(poolContent)) {
 				// match current device matches both image name and pool name, return the device
 				return idFile.Name(), nil

pkg/daemon/util/copybins.go

@@ -21,6 +21,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"path/filepath"
 )
 
 // override these for unit testing
@@ -52,13 +53,13 @@ func copyBinary(sourceDir, targetDir, filename string) error {
 		return nil
 	}
 
-	sourceFile, err := os.Open(sourcePath)
+	sourceFile, err := os.Open(filepath.Clean(sourcePath))
 	if err != nil {
 		return err
 	}
 	defer sourceFile.Close()
 
-	destinationFile, err := os.Create(targetPath)
+	destinationFile, err := os.Create(filepath.Clean(targetPath))
 	if err != nil {
 		return err
 	}

pkg/operator/ceph/cluster/mon/config.go

@@ -22,6 +22,7 @@ import (
 	"io/ioutil"
 	"os"
 	"path"
+	"path/filepath"
 	"strconv"
 	"strings"
 
@@ -253,7 +254,7 @@ func genSecret(executor exec.Executor, configDir, name string, args []string) (s
 		return "", errors.Wrapf(err, "failed to gen secret")
 	}
 
-	contents, err := ioutil.ReadFile(path)
+	contents, err := ioutil.ReadFile(filepath.Clean(path))
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to read secret file")
 	}

pkg/operator/ceph/csi/util.go

@@ -20,6 +20,7 @@ import (
 	"bytes"
 	"io/ioutil"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"text/template"
@@ -33,7 +34,7 @@ import (
 )
 
 func loadTemplate(name, templatePath string, p templateParam) (string, error) {
-	b, err := ioutil.ReadFile(templatePath)
+	b, err := ioutil.ReadFile(filepath.Clean(templatePath))
 	if err != nil {
 		return "", err
 	}

pkg/operator/k8sutil/prometheus.go

@@ -21,6 +21,7 @@ import (
 	"bytes"
 	"fmt"
 	"io/ioutil"
+	"path/filepath"
 
 	monitoringv1 "github.com/coreos/prometheus-operator/pkg/apis/monitoring/v1"
 	monitoringclient "github.com/coreos/prometheus-operator/pkg/client/versioned"
@@ -41,7 +42,7 @@ func getMonitoringClient() (*monitoringclient.Clientset, error) {
 
 // GetServiceMonitor returns servicemonitor or an error
 func GetServiceMonitor(filePath string) (*monitoringv1.ServiceMonitor, error) {
-	file, err := ioutil.ReadFile(filePath)
+	file, err := ioutil.ReadFile(filepath.Clean(filePath))
 	if err != nil {
 		return nil, fmt.Errorf("servicemonitor file could not be fetched. %v", err)
 	}
@@ -78,7 +79,7 @@ func CreateOrUpdateServiceMonitor(serviceMonitorDefinition *monitoringv1.Service
 
 // GetPrometheusRule returns provided prometheus rules or an error
 func GetPrometheusRule(ruleFilePath string) (*monitoringv1.PrometheusRule, error) {
-	ruleFile, err := ioutil.ReadFile(ruleFilePath)
+	ruleFile, err := ioutil.ReadFile(filepath.Clean(ruleFilePath))
 	if err != nil {
 		return nil, fmt.Errorf("prometheusRules file could not be fetched. %v", err)
 	}

pkg/util/file.go

@@ -40,7 +40,7 @@ func WriteFile(filePath string, contentBuffer bytes.Buffer) error {
 }
 
 func WriteFileToLog(logger *capnslog.PackageLogger, path string) {
-	contents, err := ioutil.ReadFile(path)
+	contents, err := ioutil.ReadFile(filepath.Clean(path))
 	if err != nil {
 		logger.Warningf("failed to write file %s to log: %+v", path, err)
 		return