Edge-home-orchestration-go: [๋ณด์•ˆ] ์‚ฌ์šฉ์ž ์ œ์–ด ์†Œ์Šค์—์„œ ๋นŒ๋“œ๋œ CWE-78 ๋ช…๋ น

์— ๋งŒ๋“  2021๋…„ 05์›” 06์ผ  ยท  3์ฝ”๋ฉ˜ํŠธ  ยท  ์ถœ์ฒ˜: lf-edge/edge-home-orchestration-go

CWE-78 ๋ณด์•ˆ ๋ฌธ์ œ๋Š” lgtm ๋ฐ CodeQL์—์„œ ๊ฐ์ง€๋˜์—ˆ์Šต๋‹ˆ๋‹ค.
๋„ค์ดํ‹ฐ๋ธŒ ์•ฑ์„ ์‹คํ–‰ํ•˜๋Š” ์ž…๋ ฅ์— ์•…์„ฑ ๋ฌธ์ž์—ด์ด ํฌํ•จ๋˜์–ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜๋Š” ํ”„๋กœ์„ธ์Šค๊ฐ€ ํ•„์š”ํ•ฉ๋‹ˆ๋‹ค.

high priority

๊ฐ€์žฅ ์œ ์šฉํ•œ ๋Œ“๊ธ€

@tdrozdovsky @t25kim์˜ ์ œ์•ˆ์— ๋Œ€ํ•ด ์–ด๋–ป๊ฒŒ ์ƒ๊ฐํ•˜์„ธ์š”?

๋ชจ๋“  3 ๋Œ“๊ธ€

@tdrozdovsky @t25kim์˜ ์ œ์•ˆ์— ๋Œ€ํ•ด ์–ด๋–ป๊ฒŒ ์ƒ๊ฐํ•˜์„ธ์š”?

@tdrozdovsky ์ด ๋ฌธ์ œ๋Š” #297๊ณผ ๊ฐ™์ด CWE-78๊ณผ ๊ด€๋ จ์ด ์—†๋Š” ๋‹ค๋ฅธ PR์— ์˜ํ–ฅ์„ ๋ฏธ์น˜๋ฏ€๋กœ ๊ฐ€๋Šฅํ•œ ํ•œ ๋นจ๋ฆฌ ์ˆ˜์ •๋˜์–ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. ๋„ค์ดํ‹ฐ๋ธŒ ์•ฑ์„ ์‹œ์ž‘ํ•˜๋Š” ์ฝ”๋“œ ์•ž์— ๋ช…๋ น ์œ ํšจ์„ฑ ๊ฒ€์‚ฌ๋ฅผ ์œ„ํ•œ ๋ช‡ ๊ฐ€์ง€ ์ฝ”๋“œ๋ฅผ ๋„ฃ์—ˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ CodeQL์€ ์—ฌ์ „ํžˆ โ€‹โ€‹CWE-78์„ ๊ฐ์ง€ํ•ฉ๋‹ˆ๋‹ค.
์ด ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•  ๋‹ค๋ฅธ ๋ฐฉ๋ฒ•์ด ์žˆ์Šต๋‹ˆ๊นŒ? ์•„๋‹ˆ๋ฉด PR #299๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ False positive ๋กœ ํ‘œ์‹œํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๊นŒ?

์ด ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•ด ์ฃผ์…”์„œ ๊ฐ์‚ฌํ•ฉ๋‹ˆ๋‹ค. ์•ž์„œ ๋„ค์ดํ‹ฐ๋ธŒ ๋ชจ๋“œ์— ํฐ ์ทจ์•ฝ์ ์ด ์žˆ๋‹ค๊ณ  ๊ธ€์„ ์ผ๋Š”๋ฐ ์‹œ์Šคํ…œ์ด ์ด๋ฅผ ๊ฐ์ง€ํ•˜์ง€ ๋ชปํ•œ๋‹ค๋Š” ์‚ฌ์‹ค์— ๋†€๋ž๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ ์ด์ œ ๋ชจ๋“  ๊ฒƒ์ด ์˜ฌ๋ฐ”๋ฅด๊ฒŒ ํ‘œ์‹œ๋˜๊ณ  ์ทจ์•ฝ์ ์ด ๊ฐ์ง€๋ฉ๋‹ˆ๋‹ค.
์ด ๋ฌธ์ œ๋Š” Linux ์ปค๋„ ๋ณดํ˜ธ ๋ฉ”์ปค๋‹ˆ์ฆ˜์„ ์‚ฌ์šฉํ•˜์—ฌ ์‹œ์Šคํ…œ ์ˆ˜์ค€์—์„œ๋งŒ ์™„์ „ํžˆ ํ•ด๊ฒฐํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๊ทธ๋Ÿฌ๋‚˜ ๋‚˜๋Š” ์šฐ๋ฆฌ์˜ ํ”„๋กœ์ ํŠธ ๋‚ด์—์„œ ๊ทธ๊ฒƒ์„ ํ•ด๊ฒฐํ•˜๋ ค๊ณ  ๋…ธ๋ ฅํ•  ๊ฒƒ์ž…๋‹ˆ๋‹ค. TLS ์ž‘์—…์„ ๋งˆ์น˜๋ฉด ์ฆ‰์‹œ ์ด ๋ฌธ์ œ๋ฅผ ํ•ด๊ฒฐํ•ฉ๋‹ˆ๋‹ค.

์ด ํŽ˜์ด์ง€๊ฐ€ ๋„์›€์ด ๋˜์—ˆ๋‚˜์š”?
0 / 5 - 0 ๋“ฑ๊ธ‰