SystemSh0cker/gocsaf
1
0
Fork 0
mirror of https://github.com/gocsaf/csaf.git synced 2025-12-22 18:15:42 +01:00
Code Issues Releases Activity Actions

Check that filename matches ID in csaf_checker

Browse source
This commit is contained in:
Bernhard Herzog 2023-04-25 19:24:59 +02:00
parent 900da91687
commit c37b127d82
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
cmd/csaf_checker/processor.go
View file

@ -423,6 +423,7 @@ func (p *processor) integrity(
client := p.httpClient() client := p.httpClient()
var data bytes.Buffer var data bytes.Buffer
eval := util.NewPathEval()
makeAbs := func(u *url.URL) *url.URL { makeAbs := func(u *url.URL) *url.URL {
if u.IsAbs() { if u.IsAbs() {
@ -512,6 +513,13 @@ func (p *processor) integrity(
p.invalidAdvisories.error("CSAF file %s has %d validation errors.", u, len(errors)) p.invalidAdvisories.error("CSAF file %s has %d validation errors.", u, len(errors))
} }
if err := util.IDMatchesFilename(eval, doc, filepath.Base(u)); err != nil {
p.invalidAdvisories.error("%s: %v\n", u, err)
continue
}
// Validate against remote validator. // Validate against remote validator.
if p.validator != nil { if p.validator != nil {
if rvr, err := p.validator.Validate(doc); err != nil { if rvr, err := p.validator.Validate(doc); err != nil {