regex path var check

IBM-Cloud · May 15, 2024 · dab4b37 · dab4b37
1 parent 298d3d3
commit dab4b37
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/rules/lock/lock.go b/rules/lock/lock.go
@@ -2,6 +2,8 @@ package lock
 
 import (
 	"errors"
+	"fmt"
+	"regexp"
 	"time"
 
 	"golang.org/x/net/context"
@@ -54,6 +56,10 @@ type v3Locker struct {
 }
 
 func (v3l *v3Locker) Lock(key string, options ...Option) (RuleLock, error) {
+	validPath := regexp.MustCompile(`^[[:alnum:] \"\'\_\.\,\*\=\-]+$`)
+	if !validPath.MatchString(key) {
+		return nil, fmt.Errorf("Path variable contains an invalid character")
+	}
 	return v3l.lockWithTimeout(key, v3l.lockTimeout)
 }
 func (v3l *v3Locker) lockWithTimeout(key string, timeout int) (RuleLock, error) {