Bau 28227 codeception vulnerabilities 500 part 1

[remus-iesan-natterbox]

This pull request addresses BAU-28227 by introducing several security hardening measures to mitigate path traversal and related vulnerabilities in the Codeception codebase. The following core changes were made:

Summary of Changes

1. Path Validation and Sanitization

   • Added strict validation and realpath checks for output, log, and database file paths to ensure they remain within the project directory.
   • Introduced helper methods (sanitizePath, sanitizeFilename, etc.) to centralize path validation across modules.

2. Directory and File Handling Improvements

   • Updated logic for creating and writing to directories and files to use safe, validated paths.
   • Ensured that directory creation, permission checks, and file operations throw exceptions when invalid or insecure paths are detected.

3. Module Updates

   • Filesystem Module: Enhanced file and directory access methods with path sanitization, preventing access outside the project directory.
   • Sqlite Driver: File operations (cleanup, snapshot, load) now strictly use sanitized filenames within the allowed scope.
   • Configuration: Output and log directories are validated, and any detected path traversal results in a configuration exception.

List of Modified Files

• src/Codeception/Command/GenerateScenarios.php: Added realpath validation for scenario output paths.
• src/Codeception/Configuration.php: Hardened output/log directory path handling; added project directory checks.
• src/Codeception/Lib/Driver/Sqlite.php: Updated file operations to ensure database files remain within the project directory.
• src/Codeception/Module/Filesystem.php: Introduced and utilized sanitizePath for all filesystem operations.

[natterbox-integration]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

✅ license/snyk check is complete. No issues have been found. (View Details)

✅ code/snyk check is complete. No issues have been found. (View Details)

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca