[L5] file| config substitution allows reading arbitrary filesystem paths

[pradeepto]

Severity: Low

Category

Broken Access Control (OWASP A01)

Files

pkg/config/loader.go:177-184

Description

The file| substitution in config loading reads arbitrary filesystem paths with no restriction. A misconfigured or tampered config could read files like /var/run/secrets/kubernetes.io/serviceaccount/token or other sensitive paths in the container.

The distroless base image mitigates this since very few files exist in the container but it is not a complete defense.

Fix

Restrict file| paths to an allowed directory:

if !strings.HasPrefix(filepath.Clean(path), "/appconfig/secrets/") {
    return "", fmt.Errorf("file| path must be under /appconfig/secrets/: %s", path)
}