Ashutosh Narkar 10f4d553e6 loader: Block reading of UNC paths ...

If a UNC path is provided to OPA it won't read it
and instead return an error. This applies to paths
to load bundles and individual data/policy files.

One reason behind blocking UNC paths is they could
trigger a NTLMv2 hash leak. For example, if a SMB share
is provided, OPA will attempt to open it triggering LLMNR
queries which contain the client's NTLMv2 hash which can be cracked
using some tools. This could be exploited by a malicious user.

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>

2024-08-16 12:14:55 -07:00

..

extension

loader: change extension handler type (#6015)

2023-06-16 09:37:33 +02:00

filter

loader: add support for fs.FS (#5069)

2022-09-06 14:06:27 +02:00

internal/embedtest

loader: add support for fs.FS (#5069)

2022-09-06 14:06:27 +02:00

errors.go

Use a better error message when trying to merge non-objects (#6805)

2024-06-11 09:46:08 +02:00

loader_test.go

loader: Block reading of UNC paths

2024-08-16 12:14:55 -07:00

loader.go

loader: Block reading of UNC paths

2024-08-16 12:14:55 -07:00