feat: add newpage for better readability

enowars · Aug 13, 2024 · 445baaf · 445baaf
1 parent b8160b8
commit 445baaf
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 0 deletions.
diff --git a/documentation/documentation.pdf b/documentation/documentation.pdf
diff --git a/documentation/documentation/src/main.tex b/documentation/documentation/src/main.tex
@@ -382,6 +382,7 @@ \subsection{How it works}
 
 The extracted DEVENV and \robotomonoRegular{uuid} are saved in the current requests context. We can see, that \robotomonoRegular{id} is seemingly sanitized via \robotomonoRegular{util.ExtractUuid}. Instead of using the DEVENV from the context (that definitely belongs to the current user), the eventually executed controller function \robotomonoRegular{GetFileContent} uses the \robotomonoRegular{uuid} to compute the path of the requested file content.
 
+\newpage
 \lstinputlisting[caption=service/backend/controller/devenv.go\ (lines\ 239-262), style=go, label={lst:devenv-file-content-snippet}]{src/devenv-file-content-snippet.go}
 
 Herein lies the second vulnerability. Due to the \robotomonoRegular{util.ExtractUuid} function which does not sanitize user input correctly, the adversary is able to use path traversal to retrieve the contents of files belonging to DEVENVs owned by other users.