From 0041fbe77711f66655c05af049e67f6c6a5c2489 Mon Sep 17 00:00:00 2001 From: Julian Lechner Date: Thu, 24 Sep 2026 22:03:18 +0200 Subject: [PATCH] docs(security): strengthen file guidance --- shared/rules/security/references/files.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/shared/rules/security/references/files.md b/shared/rules/security/references/files.md index e8a8a59..39918ff 100644 --- a/shared/rules/security/references/files.md +++ b/shared/rules/security/references/files.md @@ -1,6 +1,10 @@ # File and process security * Validate filenames, content, sizes, and paths; prevent traversal, zip-slip, and unsafe symbolic-link use. -* Restrict access to intended directories and do not execute uploaded or untrusted files. -* Do not concatenate untrusted input into shell commands; prefer direct APIs and validate process arguments when execution is required. -* Treat local files, IPC, and deserialized input as untrusted at relevant boundaries. +* Resolve paths against a trusted root and verify the canonical result remains inside it. Account for symlink or reparse-point changes where an attacker can modify directories. +* Restrict filesystem permissions to the intended identity and directory. Use safe temporary-file creation and avoid predictable names or permissive shared locations. +* Validate upload content using limits and format-aware parsing; do not trust names or client-supplied MIME types. Store untrusted uploads outside executable or public paths. +* Limit archive entry count, nesting, total expanded size, and path destinations to prevent traversal and resource exhaustion. +* Do not execute uploaded or untrusted files. Avoid shell execution; when a process is required, fix the executable and pass validated arguments through structured process APIs. +* Treat local files, IPC, and deserialized input as untrusted at relevant boundaries. Use explicit deserialization types and bound depth, size, and processing time. +* Avoid insecure temporary-file handoff and check permissions and ownership before consuming files from shared or attacker-writable locations.