fix: prevent tar option injection

agent/utils/files/tar.go

@@ -43,7 +43,7 @@ func (t TarArchiver) Compress(ctx context.Context, sourcePaths []string, dstFile
 		return err
 	}
 	baseDir := filepath.Dir(sourcePaths[0])
-	args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir}
+	args := []string{t.getOptionStr("compress"), dstFile, "-C", baseDir, "--"}
 	for _, sourcePath := range sourcePaths {
 		args = append(args, filepath.Base(sourcePath))
 	}

agent/utils/files/tar_gz.go

@@ -55,9 +55,9 @@ func (t TarGzArchiver) Compress(ctx context.Context, sourcePaths []string, dstFi
 		aheadDir = "/"
 	}
 	if len(secret) != 0 {
-		err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir}, itemDirs...)...)
+		err = runTarGzEncryptToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, secret, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
 	} else {
-		err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir}, itemDirs...)...)
+		err = runTarGzToFile(cmd.NewCommandMgr(cmd.WithContext(ctx)), tmpFile, append([]string{"-C", aheadDir, "--"}, itemDirs...)...)
 	}
 	if err != nil {
 		return err

agent/utils/req_helper/external_http.go

@@ -1,39 +0,0 @@
-package req_helper
-
-import (
-	"crypto/tls"
-	"errors"
-	"net/http"
-	"time"
-)
-
-func newExternalHTTPClient(transport *http.Transport, timeout time.Duration) *http.Client {
-	if transport == nil {
-		transport = http.DefaultTransport.(*http.Transport)
-	}
-	verified := transport.Clone()
-	if verified.TLSClientConfig == nil {
-		verified.TLSClientConfig = &tls.Config{}
-	} else {
-		verified.TLSClientConfig = verified.TLSClientConfig.Clone()
-	}
-	verified.TLSClientConfig.InsecureSkipVerify = false
-	verified.TLSClientConfig.ServerName = ""
-	verified.DialTLS = nil
-	verified.DialTLSContext = nil
-	return &http.Client{
-		Timeout:       timeout,
-		Transport:     verified,
-		CheckRedirect: checkExternalRedirect,
-	}
-}
-
-func checkExternalRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return errors.New("stopped after 10 redirects")
-	}
-	if len(via) > 0 && via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https" {
-		return errors.New("refusing HTTPS redirect to an insecure scheme")
-	}
-	return nil
-}

agent/utils/req_helper/request.go

@@ -2,6 +2,7 @@ package req_helper
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"io"
 	"net"
@@ -20,7 +21,10 @@ import (
 )
 
 func HandleGet(url string) (*http.Response, error) {
-	client := newExternalHTTPClient(loadRequestTransport(), time.Second*300)
+	client := &http.Client{
+		Timeout: time.Second * 300,
+	}
+	client.Transport = loadRequestTransport()
 	defer client.CloseIdleConnections()
 
 	req, err := http.NewRequestWithContext(context.Background(), "GET", url, nil)
@@ -49,9 +53,8 @@ func HandleGet(url string) (*http.Response, error) {
 
 func HandleRequest(url, method string, timeout int) (int, []byte, error) {
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
-	return HandleRequestWithClient(client, url, method, timeout)
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
+	return HandleRequestWithClient(&client, url, method, timeout)
 }
 
 func HandleRequestWithClient(client *http.Client, url, method string, timeout int) (int, []byte, error) {
@@ -133,8 +136,7 @@ func RequestFile(url, method string, timeout int) (io.ReadCloser, context.Cancel
 		}
 	}()
 	transport := xpack.MultiNodeProvider.LoadRequestTransport()
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	request, err := http.NewRequestWithContext(ctx, method, url, nil)
 	if err != nil {
@@ -154,6 +156,7 @@ func RequestFile(url, method string, timeout int) (io.ReadCloser, context.Cancel
 
 func loadRequestTransport() *http.Transport {
 	return &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,

core/utils/req_helper/external_http.go

@@ -1,39 +0,0 @@
-package req_helper
-
-import (
-	"crypto/tls"
-	"errors"
-	"net/http"
-	"time"
-)
-
-func newExternalHTTPClient(transport *http.Transport, timeout time.Duration) *http.Client {
-	if transport == nil {
-		transport = http.DefaultTransport.(*http.Transport)
-	}
-	verified := transport.Clone()
-	if verified.TLSClientConfig == nil {
-		verified.TLSClientConfig = &tls.Config{}
-	} else {
-		verified.TLSClientConfig = verified.TLSClientConfig.Clone()
-	}
-	verified.TLSClientConfig.InsecureSkipVerify = false
-	verified.TLSClientConfig.ServerName = ""
-	verified.DialTLS = nil
-	verified.DialTLSContext = nil
-	return &http.Client{
-		Timeout:       timeout,
-		Transport:     verified,
-		CheckRedirect: checkExternalRedirect,
-	}
-}
-
-func checkExternalRedirect(req *http.Request, via []*http.Request) error {
-	if len(via) >= 10 {
-		return errors.New("stopped after 10 redirects")
-	}
-	if len(via) > 0 && via[len(via)-1].URL.Scheme == "https" && req.URL.Scheme != "https" {
-		return errors.New("refusing HTTPS redirect to an insecure scheme")
-	}
-	return nil
-}

core/utils/req_helper/requset.go

@@ -2,6 +2,7 @@ package req_helper
 
 import (
 	"context"
+	"crypto/tls"
 	"errors"
 	"io"
 	"net"
@@ -16,6 +17,7 @@ import (
 
 func HandleRequest(url, method string, timeout int) (int, []byte, error) {
 	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,
@@ -40,8 +42,7 @@ func handleRequestWithTransport(url, method string, transport *http.Transport, t
 		}
 	}()
 
-	client := newExternalHTTPClient(transport, time.Duration(timeout)*time.Second)
-	defer client.CloseIdleConnections()
+	client := http.Client{Timeout: time.Duration(timeout) * time.Second, Transport: transport}
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(timeout)*time.Second)
 	defer cancel()
 	request, err := http.NewRequestWithContext(ctx, method, url, nil)
@@ -64,6 +65,7 @@ func handleRequestWithTransport(url, method string, transport *http.Transport, t
 
 func HandleGet(url string) (*http.Response, error) {
 	transport := &http.Transport{
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
 		DialContext: (&net.Dialer{
 			Timeout:   60 * time.Second,
 			KeepAlive: 60 * time.Second,
@@ -81,7 +83,10 @@ func HandleGetWithProxy(url string) (*http.Response, error) {
 }
 
 func handleGetWithTransport(url string, transport *http.Transport) (*http.Response, error) {
-	client := newExternalHTTPClient(transport, time.Second*300)
+	client := &http.Client{
+		Timeout: time.Second * 300,
+	}
+	client.Transport = transport
 	defer client.CloseIdleConnections()
 
 	req, err := http.NewRequestWithContext(context.Background(), "GET", url, nil)