Investigate vulnerability: Potential file inclusion via variable

Issue created from vulnerability 855

Description:

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

• Severity: medium
• Confidence: high
• Location: nucleus/util/proto/message.go:31

Identifiers:

• Gosec Rule ID G304
• CWE-22

Scanner:

• Name: Gosec