SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 11:55:40 +01:00
Code Issues Releases Activity Actions

Use JoinPath

Browse source 
This avoids issues where parts of the URL are discarded.
This commit is contained in:
koplas 2025-06-19 15:11:45 +02:00
parent cb291bb81b
commit 6ac97810d0
No known key found for this signature in database
6 changed files with 37 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

11
cmd/csaf_checker/processor.go
View file

@ -18,6 +18,7 @@ import (
"encoding/json"
"errors"
"fmt"
"github.com/gocsaf/csaf/v3/internal/misc"
"io"
"log"
"net/http"
@ -644,7 +645,7 @@ func (p *processor) integrity(
}
fp = makeAbs(fp)
u := b.ResolveReference(fp).String()
u := misc.JoinURL(b, fp).String()
// Should this URL be ignored?
if p.cfg.ignoreURL(u) {
@ -777,7 +778,7 @@ func (p *processor) integrity(
continue
}
hu = makeAbs(hu)
hashFile := b.ResolveReference(hu).String()
hashFile := misc.JoinURL(b, hu).String()
p.checkTLS(hashFile)
if res, err = client.Get(hashFile); err != nil {
@ -827,7 +828,7 @@ func (p *processor) integrity(
continue
}
su = makeAbs(su)
sigFile := b.ResolveReference(su).String()
sigFile := misc.JoinURL(b, su).String()
p.checkTLS(sigFile)
p.badSignatures.use()
@ -1374,7 +1375,7 @@ func (p *processor) checkSecurityFolder(folder string) string {
return err.Error()
}
u = base.ResolveReference(up).String()
u = misc.JoinURL(base, up).String()
p.checkTLS(u)
if res, err = client.Get(u); err != nil {
return fmt.Sprintf("Cannot fetch %s from security.txt: %v", u, err)
@ -1539,7 +1540,7 @@ func (p *processor) checkPGPKeys(_ string) error {
continue
}
u := base.ResolveReference(up).String()
u := misc.JoinURL(base, up).String()
p.checkTLS(u)
res, err := client.Get(u)