Address snyk and dependabot issues

Signed-off-by: Jonathon Anderson <janderson@ciq.com>

internal/pkg/node/datastructure.go

@@ -1,12 +1,19 @@
 package node
 
 import (
+	"encoding/gob"
 	"net"
 
 	"github.com/warewulf/warewulf/internal/pkg/util"
 	"github.com/warewulf/warewulf/internal/pkg/wwtype"
 )
 
+func init() {
+	gob.Register([]interface{}{})
+	gob.Register(map[string]interface{}{})
+	gob.Register(map[interface{}]interface{}{})
+}
+
 /******
  * YAML data representations
  ******/

internal/pkg/overlay/config.go

@@ -5,6 +5,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"regexp"
 	"strings"
 
 	"github.com/containers/storage/drivers/copy"
@@ -14,8 +15,23 @@ import (
 	"github.com/warewulf/warewulf/internal/pkg/wwlog"
 )
 
+var validOverlayName = regexp.MustCompile(`^[a-zA-Z0-9\-._:]+$`)
+
+func validateOverlayName(name string) error {
+	if name == "" {
+		return fmt.Errorf("overlay name must not be empty")
+	}
+	if !validOverlayName.MatchString(name) {
+		return fmt.Errorf("overlay name contains illegal characters: %s", name)
+	}
+	return nil
+}
+
 // Get returns the filesystem path of an overlay identified by its name,
 func Get(name string) (overlay Overlay, err error) {
+	if err := validateOverlayName(name); err != nil {
+		return "", err
+	}
 	overlay = getSiteOverlay(name)
 	if overlay.Exists() {
 		return overlay, nil
@@ -31,6 +47,9 @@ func Get(name string) (overlay Overlay, err error) {
 //
 // Returns an error if the overlay already exists or if directory creation fails.
 func Create(name string) (overlay Overlay, err error) {
+	if err := validateOverlayName(name); err != nil {
+		return "", err
+	}
 	overlay = getSiteOverlay(name)
 	if overlay.Exists() {
 		return overlay, fmt.Errorf("overlay already exists: %s", name)

internal/pkg/overlay/config_test.go

@@ -25,6 +25,34 @@ var overlayImageTests = []struct {
 	{"node with context and overlays", "node1", "system", []string{"o1", "o2"}, "p/overlays/node1/__SYSTEM__.img"},
 }
 
+var validateOverlayNameTests = []struct {
+	name    string
+	wantErr bool
+}{
+	{"valid", false},
+	{"valid-with-dashes", false},
+	{"valid.with.dots", false},
+	{"valid_underscore", false},
+	{"", true},
+	{"../../etc", true},
+	{"../foo", true},
+	{"/etc/passwd", true},
+	{"foo/bar", true},
+	{"foo bar", true},
+	{"foo\x00bar", true},
+}
+
+func Test_validateOverlayName(t *testing.T) {
+	for _, tt := range validateOverlayNameTests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateOverlayName(tt.name)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateOverlayName(%q) error = %v, wantErr %v", tt.name, err, tt.wantErr)
+			}
+		})
+	}
+}
+
 func Test_OverlayImage(t *testing.T) {
 	conf := warewulfconf.Get()
 	conf.Paths.WWProvisiondir = "p"

internal/pkg/warewulfd/api/image_test.go

@@ -161,7 +161,7 @@ users:
 			} else {
 				// For JSON responses
 				ja := jsonassert.New(t)
-				ja.Assertf(string(body), tt.response) //nolint:govet
+				ja.Assert(string(body), tt.response)
 			}
 
 			for _, fileName := range tt.resultFiles {

internal/pkg/warewulfd/api/node_test.go

@@ -465,7 +465,7 @@ func TestNodeAPI(t *testing.T) {
 			assert.NoError(t, resp.Body.Close())
 
 			ja := jsonassert.New(t)
-			ja.Assertf(string(body), tt.response) //nolint:govet
+			ja.Assert(string(body), tt.response)
 
 			if tt.resultConf != "" {
 				assert.YAMLEq(t, tt.resultConf, env.ReadFile("/etc/warewulf/nodes.conf"))

internal/pkg/warewulfd/api/overlay_test.go

@@ -181,7 +181,7 @@ func TestOverlayAPI(t *testing.T) {
 
 			if tt.response != "" {
 				ja := jsonassert.New(t)
-				ja.Assertf(string(body), tt.response) //nolint:govet // tt.response is used as a format string with special tokens
+				ja.Assert(string(body), tt.response)
 			}
 
 			for _, fileName := range tt.resultFiles {

internal/pkg/warewulfd/api/profile_test.go

@@ -222,7 +222,7 @@ func TestProfileAPI(t *testing.T) {
 			assert.NoError(t, resp.Body.Close())
 
 			ja := jsonassert.New(t)
-			ja.Assertf(string(body), tt.response) //nolint:govet
+			ja.Assert(string(body), tt.response)
 
 			if tt.resultConf != "" {
 				assert.YAMLEq(t, tt.resultConf, env.ReadFile("/etc/warewulf/nodes.conf"))