fix(vex): reject non-local VEX repository names (aquasecurity#10987)

Author: DmitriyLewen

pkg/vex/repo/manager.go

@@ -104,6 +104,11 @@ func (m *Manager) Config(ctx context.Context) (Config, error) {
 	}
 
 	for i, repo := range conf.Repositories {
+		// The repository name is joined onto the cache directory, so reject names that are not
+		// local relative paths to prevent path traversal (e.g., "../foo", "/foo", or "C:\foo" on Windows).
+		if !filepath.IsLocal(repo.Name) {
+			return Config{}, xerrors.Errorf("invalid repository name %q: must be a local relative path", repo.Name)
+		}
 		conf.Repositories[i].dir = filepath.Join(m.cacheDir, repoDir, repo.Name)
 	}
 

pkg/vex/repo/manager_test.go

@@ -59,6 +59,58 @@ func TestManager_Config(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "repository name with path traversal",
+			setup: func(t *testing.T, dir string) {
+				config := repo.Config{
+					Repositories: []repo.Repository{
+						{
+							Name:    filepath.Join("..", "..", "outside-target"),
+							URL:     "https://example.com/repo",
+							Enabled: true,
+						},
+					},
+				}
+				configPath := filepath.Join(dir, ".trivy", "vex", "repository.yaml")
+				testutil.MustWriteYAML(t, configPath, config)
+			},
+			wantErr: "invalid repository name",
+		},
+		{
+			name: "repository name with absolute path",
+			setup: func(t *testing.T, dir string) {
+				config := repo.Config{
+					Repositories: []repo.Repository{
+						{
+							// dir is t.TempDir(), i.e. an absolute path, so this yields an absolute repository name.
+							Name:    filepath.Join(dir, "outside-target"),
+							URL:     "https://example.com/repo",
+							Enabled: true,
+						},
+					},
+				}
+				configPath := filepath.Join(dir, ".trivy", "vex", "repository.yaml")
+				testutil.MustWriteYAML(t, configPath, config)
+			},
+			wantErr: "invalid repository name",
+		},
+		{
+			name: "empty repository name",
+			setup: func(t *testing.T, dir string) {
+				config := repo.Config{
+					Repositories: []repo.Repository{
+						{
+							Name:    "",
+							URL:     "https://example.com/repo",
+							Enabled: true,
+						},
+					},
+				}
+				configPath := filepath.Join(dir, ".trivy", "vex", "repository.yaml")
+				testutil.MustWriteYAML(t, configPath, config)
+			},
+			wantErr: "invalid repository name",
+		},
 	}
 
 	for _, tt := range tests {