mirror of
https://github.com/moby/moby.git
synced 2026-08-08 17:11:38 +00:00
30 lines
1.5 KiB
Go
30 lines
1.5 KiB
Go
// SPDX-FileCopyrightText: Copyright 2015-2025 go-swagger maintainers
|
|
// SPDX-License-Identifier: Apache-2.0
|
|
|
|
// Package loading provides tools to load a file from http or from a local file system.
|
|
//
|
|
// # Security
|
|
//
|
|
// By default, the local loader reads any path the process can access, including absolute
|
|
// paths and "file://" URIs (for example "file:///etc/passwd"). Applications that pass
|
|
// untrusted input to [LoadFromFileOrHTTP], [JSONDoc] (or to downstream consumers such as
|
|
// go-openapi/loads) must confine local loading to a trusted directory.
|
|
//
|
|
// Use [WithRoot] to do so: it resolves every requested path relative to a chosen directory
|
|
// and rejects anything that escapes it, including via symlink. It is built on [os.Root]
|
|
// and is therefore safer than passing an [os.DirFS] to [WithFS], which does not block
|
|
// symlink escapes.
|
|
//
|
|
// Remote loading uses a standard [net/http] client.
|
|
// By default it follows redirects and performs no destination filtering — exactly like [net/http.DefaultClient].
|
|
//
|
|
// A caller-controlled URL may therefore reach internal services or cloud metadata endpoints
|
|
// (server-side request forgery).
|
|
//
|
|
// This package does not, and should not, embed a network policy:
|
|
// when the URL may derive from untrusted input, supply a restricted client with
|
|
// [WithHTTPClient] whose transport rejects unwanted destinations at dial time — which also
|
|
// covers redirects and DNS rebinding.
|
|
// See the example on [LoadFromFileOrHTTP].
|
|
package loading
|