Added 3
- Add shellQuote and shellQuoteList template functions
- Add gopassCat template function
- Add debugf template function
Fixed 1
- Reject negative format-indent-width template directives
Security 14
- Fix multiple security vulnerabilities
- Tighten permissions on temporary files
- Ensure HTTP cache directory is private
- Disallow relative paths with /.. suffix
- Disallow .. in ignore and remove patterns
- Disallow .. paths in mackup files
- Disallow filenames that resolve to .
- Improve handling of untrusted relative paths
- Disallow .. paths in .chezmoiroot
- Ensure that secret keyring get command always writes a private file
- Ensure that age-keygen always writes a private file
- Make persistent state directory private by default
- Prevent directory escape in tar and rar archives
- Disallow file and directory names that resolve to ..
Changelog
Features
- f81cb321789aa3df62871248f5e4d361a59e7cc1 feat: Fix multiple security vulns thanks to secur0.com
- 1e51cc5d88e10ea04d7f74b78380693ce41cbb85 feat: Add shellQuote and shellQuoteList template funcs
- 4249f4f6c24954d3ce8bfd0d76673bb8c55869d3 feat: Add gopassCat template function
- a7d91a55f885d87be7089095c69705e499cd41a4 feat: Add debugf template function
Fixes
- 0ad679a834533d3f548c18f62ed7c97dc05a3250 fix: Tighten permissions on temporary files
- 4031be13eebd4a964242fade1b4b23688d6e4589 fix: Ensure HTTP cache dir is private
- ba5a19a2fd28e3a16d9f8d86c6c906acf229dd3e fix: Disallow relative paths with /.. suffix
- 1fe762752a243991df1a749cdf89fa3e4de7df04 fix: Disallow .. in ignore and remove patterns
- 3c9e70b5262856aee320dc68a3035ce2e344d6bf fix: Disallow .. paths in mackup files
- 01b60ddecfd021b83b174dd9ae6d54a9909bc769 fix: Disallow filenames that resolve to .
- 5cdaf4ea3613717756bece1083fde079f4e37978 fix: Improve handling of untrusted relative paths
- e8a57dc1b617068fd54cf4c998ac95bbc9150a70 fix: Disallow .. paths in .chezmoiroot
- 76e2ddf60a7b020fec4f06961ec8401e7a4c6ab9 fix: Reject negative format-indent-width template directives
- 840f68213525cdf7cdaa48a248fe751cb4361a9d fix: Ensure that secret keyring get command always writes a private file
- f7282b8127ad67d17b069ea8b4bfa1f66b8c43ef fix: Ensure that age-keygen always writes a private file
- e7cbe71abd5f51524196a45bb94c1d9b006cf577 fix: Make persistent state directory private by default
- 0d6fc2bf7ca5fd9b24fa93b09874170a0a16572b fix: Prevent directory escape in tar and rar archives
- 239cc6b9eea29698a003bf23eeb0bf112fe93006 fix: Disallow file and dir names that resolve to ..
Documentation
- a331111360f57705beb83385f2f5684514682a4c docs: Use more robust quoting functions in examples
- 80441a5fc79775e981f127e4a4c0d5575872eb55 docs: Add link to article
- 6cd634d875a99dd152b1a8fd1ae7fba67f13659f docs: Add link to article