bundesAPI / bundesAPI/handelsregister

Sanitize Company Names to Prevent Issues with Dangerous Characters in Local Cache Storage

Open
#27 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
438
Forks
61
PR merge metrics
No merged PRs in 30d

Description

### Summary:

The Handelsregister Python SDK is instrumental in fetching and caching HTML pages from the Handelsregister. Currently, the process involves storing retrieved HTML pages in a local cache without sanitizing company names. This practice could lead to potential issues, as company names with slashes ("/"), backslashes ("\"), or other dangerous characters might cause file path traversal problems or other unintended behavior when used as filenames or identifiers in the cache.

### Issue Description:
When company names contain filesystem or URL special characters (e.g., "/", "\", "?", "%", "*", ":", "|", """, "<", ">", ".", "&", "$"), it poses a risk for file storage and retrieval operations within the local cache mechanism. Specifically, characters like slashes can be interpreted by the operating system as directory separators, leading to attempts to access unintended directories or the creation of files in unexpected locations.

### Potential Impact:

**Security Risks:** Unsanitized input might lead to directory traversal vulnerabilities, allowing malicious users to access or manipulate files outside the intended cache directory.
Functionality Issues: Special characters in company names could lead to errors in file operations, such as saving or retrieving cached pages, especially if the characters are not valid for filenames in the operating system.
Steps to Reproduce:

Use the SDK to fetch data for a company with special characters in its name (e.g., "Test/Company").
Observe the behavior of the caching mechanism when attempting to store or retrieve the HTML page associated with this company name.

### Suggested Fix:

Implement a sanitization function that either removes or replaces special characters in company names before using them in file paths or filenames. This function should be applied to company names as soon as they are retrieved and before any caching operations are performed. Additionally, consider a consistent scheme for character replacement to ensure that the sanitized names remain unique and recognizable.

### Environment:

Python Version: 3.12.2
SDK Version: 1ef5e1e08b9612553ab87a9ffb723e162ecf5046
Operating System: macOS Sonoma 14.4.1 / Ubuntu Linux 24.04

Contributor guide

No contributing guide indexed for this repository

Research direction

No files or tests are named; start by locating the cache code that turns company names into file paths and handles cache reads and writes. Define a consistent, collision-aware sanitization scheme, then add coverage for the listed special characters and traversal-like names, verifying cached pages remain inside the intended cache directory.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.