fix(venom): plugin loading, TLS paths, exec hardening, SSH timeout, HTML sanitization

- venom: load .so plugins only from --lib-dir (no auto-load from workdir);
  validate plugin name against [A-Za-z0-9_-]
- http: reject absolute paths for tls_root_ca/tls_client_cert/tls_client_key;
  detect inline PEM via "-----BEGIN" marker; fail explicitly when file is
  missing
- exec: fix Windows .ps1 rename (create temp script with final name);
  create temp script atomically with O_EXCL and 0o700; document
  stdout/stderr synchronization
- ssh: add configurable `timeout` field (default 30s); restrict privatekey
  absolute paths to $HOME, resolve relative paths under workdir
- html report: sanitize markdown rendering with DOMPurify

BREAKING CHANGE: .so plugins now require --lib-dir; HTTP TLS file paths
must be relative to workdir; SSH privatekey absolute paths must be under
$HOME.

Signed-off-by: Yvonnick Esnault <yvonnick.esnault@ovhcloud.com>

Author: yesnault

README.md

@@ -419,6 +419,8 @@ Notice the variable `alljson`. All variables declared in output are automaticall
 Venom will load user-defined executors from the directory `lib/` relative to the testsuite path. You can add executor source paths using the flag `--lib-dir`. 
 Note that all folders listed with `--lib-dir` will be scanned recursively to find `.yml` files as user executors.
 
+Compiled Go plugins (`.so`) are **only** loaded from `--lib-dir`; they are no longer auto-discovered from `<workdir>/lib/`. The plugin name (the YAML `type:` field) must match `[A-Za-z0-9_-]+`.
+
 The user defined executors work with templating, you can check the templating result in `venom.log`. In this file, if you see an error such as `error converting YAML to JSON: yaml: line 14: found unexpected end of stream`, you probably need to adjust indentation with the templating function `indent`. 
 
 Example:

executors/exec/exec.go

@@ -2,9 +2,12 @@ package exec
 
 import (
 	"context"
+	"crypto/rand"
+	"encoding/hex"
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"runtime"
 	"strconv"
 	"strings"
@@ -97,48 +100,43 @@ func (Executor) Run(ctx context.Context, step venom.TestStep) (interface{}, erro
 			opts = append(opts, "-ExecutionPolicy", "Bypass", "-Command")
 		}
 
-		// Create a tmp file
-		tmpscript, err := os.CreateTemp(os.TempDir(), "venom-")
+		// Create the tmp script file atomically with the right permissions
+		// (O_EXCL avoids races, 0o700 keeps the script private to the user).
+		nameBytes := make([]byte, 16)
+		if _, err := rand.Read(nameBytes); err != nil {
+			return nil, fmt.Errorf("cannot generate tmp name: %s", err)
+		}
+		baseName := "venom-" + hex.EncodeToString(nameBytes)
+		if runtime.GOOS == "windows" {
+			baseName += ".PS1"
+		}
+		scriptPath := filepath.Join(os.TempDir(), baseName)
+		tmpscript, err := os.OpenFile(scriptPath, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0o700)
 		if err != nil {
 			return nil, fmt.Errorf("cannot create tmp file: %s", err)
 		}
 
-		// Put script in file
-		venom.Debug(ctx, "work with tmp file %s", tmpscript.Name())
+		venom.Debug(ctx, "work with tmp file %s", scriptPath)
 		n, err := tmpscript.Write([]byte(scriptContent))
 		if err != nil || n != len(scriptContent) {
+			tmpscript.Close()
+			os.Remove(scriptPath)
 			if err != nil {
 				return nil, fmt.Errorf("cannot write script: %s", err)
 			}
 			return nil, fmt.Errorf("cannot write all script: %d/%d", n, len(scriptContent))
 		}
-
-		oldPath := tmpscript.Name()
 		tmpscript.Close()
-		var scriptPath string
+
 		if runtime.GOOS == "windows" {
-			// Remove all .txt Extensions, there is not always a .txt extension
-			newPath := strings.ReplaceAll(oldPath, ".txt", "")
-			// and add .PS1 extension
-			newPath += ".PS1"
-			if err := os.Rename(oldPath, newPath); err != nil {
-				return nil, fmt.Errorf("cannot rename script to add powershell extension, aborting")
-			}
 			// This aims to stop a the very first error and return the right exit code
-			psCommand := fmt.Sprintf("& { $ErrorActionPreference='Stop'; & %s ;exit $LastExitCode}", newPath)
-			scriptPath = newPath
+			psCommand := fmt.Sprintf("& { $ErrorActionPreference='Stop'; & %s ;exit $LastExitCode}", scriptPath)
 			opts = append(opts, psCommand)
 		} else {
-			scriptPath = oldPath
 			opts = append(opts, scriptPath)
 		}
 		defer os.Remove(scriptPath)
 
-		// Chmod file
-		if err := os.Chmod(scriptPath, 0o700); err != nil {
-			return nil, fmt.Errorf("cannot chmod script %s: %s", scriptPath, err)
-		}
-
 		command = shell
 	}
 
@@ -161,6 +159,12 @@ func (Executor) Run(ctx context.Context, step venom.TestStep) (interface{}, erro
 	}
 
 	result := Result{}
+
+	// The two goroutines below are the only writers of result.Systemout and
+	// result.Systemerr. The parent reads these fields only after <-outchan
+	// and <-errchan have unblocked, which happens-after their respective
+	// close. Do not access result.Systemout / result.Systemerr from any
+	// other goroutine while the command is running.
 	outchan := make(chan bool)
 
 	go func() {
@@ -194,7 +198,7 @@ func (Executor) Run(ctx context.Context, step venom.TestStep) (interface{}, erro
 			if n > 0 {
 				chunk := buf[:n]
 				sb.Write(chunk)
-				venom.Debug(ctx, venom.HideSensitive(ctx, string(chunk)))
+				venom.Debug(ctx, "%s", venom.HideSensitive(ctx, string(chunk)))
 			}
 			if err != nil {
 				break

executors/http/README.md

@@ -23,9 +23,9 @@ In your yaml file, you can use:
   - no_follow_redirect (optional): indicates that you don't want to follow Location if server returns a Redirect (301/302/...)
   - skip_body: skip the body and bodyjson result
   - skip_headers: skip the headers result
-  - tls_client_cert (optional): a chain of certificates to identify the caller, first certificate in the chain is considered as the leaf, followed by intermediates. Setting it enables mutual TLS authentication. Set the PEM content or the path to the PEM file.
-  - tls_client_key (optional): private key corresponding to the certificate. Set the PEM content or the path to the PEM file.
-  - tls_root_ca (optional): defines additional root CAs to perform the call. Can contain multiple CAs concatenated together. Set the PEM content or the path to the PEM file.
+  - tls_client_cert (optional): a chain of certificates to identify the caller, first certificate in the chain is considered as the leaf, followed by intermediates. Setting it enables mutual TLS authentication. Provide either inline PEM content (must contain "-----BEGIN") or a path relative to the testsuite workdir. Absolute paths are rejected.
+  - tls_client_key (optional): private key corresponding to the certificate. Provide either inline PEM content or a path relative to the testsuite workdir.
+  - tls_root_ca (optional): additional root CAs used for the call. Can contain multiple CAs concatenated together. Provide either inline PEM content or a path relative to the testsuite workdir.
 
 ```
 

executors/http/http.go

@@ -428,6 +428,25 @@ func isBodyJSONSupported(resp *http.Response) bool {
 	return strings.Contains(contentType, "application/json") || strings.HasSuffix(contentType, "+json")
 }
 
+// loadPEMOrFile decides whether the given value is inline PEM content or a
+// path to a file under the testsuite workdir. Inline PEM (recognised by the
+// "-----BEGIN" marker) is returned as-is. Otherwise the value is treated as
+// a relative path, sanitised against escapes, and read from disk.
+func loadPEMOrFile(workdir, value, fieldName string) ([]byte, error) {
+	if strings.Contains(value, "-----BEGIN") {
+		return []byte(value), nil
+	}
+	resolved, err := venom.ResolveWorkdirPath(workdir, value)
+	if err != nil {
+		return nil, fmt.Errorf("invalid %s path: %w", fieldName, err)
+	}
+	data, err := os.ReadFile(resolved)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read %s from file %s: %w", fieldName, resolved, err)
+	}
+	return data, nil
+}
+
 func (e Executor) TLSOptions(ctx context.Context) ([]func(*http.Transport) error, error) {
 	var opts []func(*http.Transport) error
 
@@ -438,51 +457,28 @@ func (e Executor) TLSOptions(ctx context.Context) ([]func(*http.Transport) error
 	workdir := venom.StringVarFromCtx(ctx, "venom.testsuite.workdir")
 
 	if e.TLSRootCA != "" {
-		TLSRootCAFilepath := e.TLSRootCA
-		if !filepath.IsAbs(e.TLSRootCA) {
-			TLSRootCAFilepath = filepath.Join(workdir, e.TLSRootCA)
-		}
-		var TLSRootCA []byte
-		if _, err := os.Stat(TLSRootCAFilepath); err == nil {
-			TLSRootCA, err = os.ReadFile(TLSRootCAFilepath)
-			if err != nil {
-				return nil, fmt.Errorf("unable to read TLSRootCA from file %s", TLSRootCAFilepath)
-			}
-		} else {
-			TLSRootCA = []byte(e.TLSRootCA)
+		data, err := loadPEMOrFile(workdir, e.TLSRootCA, "TLSRootCA")
+		if err != nil {
+			return nil, err
 		}
-		opts = append(opts, WithTLSRootCA(ctx, TLSRootCA))
+		opts = append(opts, WithTLSRootCA(ctx, data))
 	}
 
 	var TLSClientCert, TLSClientKey []byte
 	if e.TLSClientCert != "" {
-		TLSClientCertFilepath := e.TLSClientCert
-		if !filepath.IsAbs(e.TLSClientCert) {
-			TLSClientCertFilepath = filepath.Join(workdir, e.TLSClientCert)
-		}
-		if _, err := os.Stat(TLSClientCertFilepath); err == nil {
-			TLSClientCert, err = os.ReadFile(TLSClientCertFilepath)
-			if err != nil {
-				return nil, fmt.Errorf("unable to read TLSClientCert from file %s", TLSClientCertFilepath)
-			}
-		} else {
-			TLSClientCert = []byte(e.TLSClientCert)
+		data, err := loadPEMOrFile(workdir, e.TLSClientCert, "TLSClientCert")
+		if err != nil {
+			return nil, err
 		}
+		TLSClientCert = data
 	}
 
 	if e.TLSClientKey != "" {
-		TLSClientKeyFilepath := e.TLSClientKey
-		if !filepath.IsAbs(e.TLSClientKey) {
-			TLSClientKeyFilepath = filepath.Join(workdir, e.TLSClientKey)
-		}
-		if _, err := os.Stat(TLSClientKeyFilepath); err == nil {
-			TLSClientKey, err = os.ReadFile(TLSClientKeyFilepath)
-			if err != nil {
-				return nil, fmt.Errorf("unable to read TLSClientKey from file %s", TLSClientKeyFilepath)
-			}
-		} else {
-			TLSClientKey = []byte(e.TLSClientKey)
+		data, err := loadPEMOrFile(workdir, e.TLSClientKey, "TLSClientKey")
+		if err != nil {
+			return nil, err
 		}
+		TLSClientKey = data
 	}
 
 	if len(TLSClientCert) > 0 && len(TLSClientKey) > 0 {

executors/http/http_test.go

@@ -16,48 +16,61 @@ import (
 	"github.com/ovh/venom"
 )
 
-func generateClientFile(t *testing.T) (string, string) {
-	TLSClientKey, err := os.CreateTemp(os.TempDir(), "TLSClientKey.*.key")
-	require.NoError(t, err)
-	TLSClientKeyFileName := TLSClientKey.Name()
-	t.Logf("generating file %q", TLSClientKeyFileName)
-	cmd := exec.Command("openssl", "genrsa", "-out", TLSClientKeyFileName, "2048")
+// generateClientFile creates a TLS key and self-signed certificate inside dir.
+// Returns the file names (relative to dir) so tests can resolve them through
+// venom.ResolveWorkdirPath.
+func generateClientFile(t *testing.T, dir string) (string, string) {
+	keyPath := "TLSClientKey.key"
+	certPath := "TLSClientCert.crt"
+	absKey := dir + "/" + keyPath
+	absCert := dir + "/" + certPath
+
+	t.Logf("generating file %q", absKey)
+	cmd := exec.Command("openssl", "genrsa", "-out", absKey, "2048")
 	output, err := cmd.CombinedOutput()
 	t.Log(string(output))
 	require.NoError(t, err)
 
-	TLSClientCert, err := os.CreateTemp(os.TempDir(), "TLSClientCert.*.crt")
-	require.NoError(t, err)
-	TLSClientCertFilename := TLSClientCert.Name()
-	t.Logf("generating file %q", TLSClientCertFilename)
-	cmd = exec.Command("openssl", "req", "-batch", "-subj", "/C=GB/ST=Yorks/L=York/O=MyCompany Ltd./OU=IT/CN=mysubdomain.mydomain.com", "-new", "-x509", "-sha256", "-key", TLSClientKeyFileName, "-out", TLSClientCertFilename, "-days", "365")
+	t.Logf("generating file %q", absCert)
+	cmd = exec.Command("openssl", "req", "-batch", "-subj", "/C=GB/ST=Yorks/L=York/O=MyCompany Ltd./OU=IT/CN=mysubdomain.mydomain.com", "-new", "-x509", "-sha256", "-key", absKey, "-out", absCert, "-days", "365")
 	output, err = cmd.CombinedOutput()
 	t.Log(string(output))
 	require.NoError(t, err)
 
-	return TLSClientKeyFileName, TLSClientCertFilename
+	return keyPath, certPath
+}
+
+func ctxWithWorkdir(workdir string) context.Context {
+	return context.WithValue(context.Background(), venom.ContextKey("var.venom.testsuite.workdir"), workdir)
 }
 
 func TestExecutor_TLSOptions_From_File(t *testing.T) {
-	TLSClientKeyFileName, TLSClientCertFilename := generateClientFile(t)
+	workdir := t.TempDir()
+	keyName, certName := generateClientFile(t, workdir)
+
+	rootCA, err := os.ReadFile("../../tests/http/tls/digicert-root-ca.crt")
+	require.NoError(t, err)
+	rootCAPath := "digicert-root-ca.crt"
+	require.NoError(t, os.WriteFile(workdir+"/"+rootCAPath, rootCA, 0o600))
 
 	e := Executor{
 		IgnoreVerifySSL: true,
-		TLSClientCert:   TLSClientCertFilename,
-		TLSClientKey:    TLSClientKeyFileName,
-		TLSRootCA:       "../../tests/http/tls/digicert-root-ca.crt",
+		TLSClientCert:   certName,
+		TLSClientKey:    keyName,
+		TLSRootCA:       rootCAPath,
 	}
-	opts, err := e.TLSOptions(context.Background())
+	opts, err := e.TLSOptions(ctxWithWorkdir(workdir))
 	require.NoError(t, err)
 	require.Len(t, opts, 3)
 }
 
 func TestExecutor_TLSOptions_From_String(t *testing.T) {
-	TLSClientKeyFileName, TLSClientCertFilename := generateClientFile(t)
+	workdir := t.TempDir()
+	keyName, certName := generateClientFile(t, workdir)
 
-	TLSClientCert, err := os.ReadFile(TLSClientCertFilename)
+	TLSClientCert, err := os.ReadFile(workdir + "/" + certName)
 	require.NoError(t, err)
-	TLSClientKey, err := os.ReadFile(TLSClientKeyFileName)
+	TLSClientKey, err := os.ReadFile(workdir + "/" + keyName)
 	require.NoError(t, err)
 	TLSRootCA, err := os.ReadFile("../../tests/http/tls/digicert-root-ca.crt")
 	require.NoError(t, err)
@@ -66,11 +79,19 @@ func TestExecutor_TLSOptions_From_String(t *testing.T) {
 		TLSClientKey:  string(TLSClientKey),
 		TLSRootCA:     string(TLSRootCA),
 	}
-	opts, err := e.TLSOptions(context.Background())
+	opts, err := e.TLSOptions(ctxWithWorkdir(workdir))
 	require.NoError(t, err)
 	require.Len(t, opts, 2)
 }
 
+func TestExecutor_TLSOptions_RejectAbsolutePath(t *testing.T) {
+	e := Executor{
+		TLSRootCA: "/etc/ssl/certs/ca-certificates.crt",
+	}
+	_, err := e.TLSOptions(ctxWithWorkdir(t.TempDir()))
+	require.Error(t, err)
+}
+
 func TestInterpolation_Of_String(t *testing.T) {
 	e := &Executor{
 		Method:           "",

executors/imap/README.md

@@ -10,6 +10,7 @@ Venom IMAP executor implements a few IMAP commands such as FETCH, APPEND, MOVE,
 ```yaml
 auth:
   withtls: false
+  ignore_verify_ssl: false # Optional, default false. Set to true to disable TLS certificate verification (e.g. self-signed certs).
   host: yourimaphost
   port: 143 # Most probably 993 if using TLS
   user: imap@venom.com

executors/plugins/README.md

@@ -77,10 +77,14 @@ testcases:
     - result.body ShouldContainSubstring world
 ```
 
-Run venom:
+Run venom (the `--lib-dir` flag must point to the directory containing the
+compiled `.so` plugin; auto-discovery from the testsuite workdir is no longer
+supported for security reasons):
 
 ```
-$ ./venom run test.yml
+$ ./venom run --lib-dir=./lib test.yml
 ```
 
+Plugin names are restricted to the `[A-Za-z0-9_-]` character set.
+
 Feel free to open a Pull Request with your executors.

executors/smtp/README.md

@@ -14,6 +14,7 @@ testcases:
   steps:
   - type: smtp
     withtls: false
+    ignore_verify_ssl: false # Optional, default false. Set to true to disable TLS certificate verification (e.g. self-signed certs).
     host: localhost
     port: 25 # 465 if using TLS
     user: yourSMTPUsername # Optional, only works with TLS

executors/ssh/README.md

@@ -12,9 +12,16 @@ In your yaml file, you can use:
   - command mandatory
   - user optional (default is OS username)
   - password optional (mandatory if no privatekey is found)
-  - privatekey optional (default is $HOME/.ssh/id_rsa)
+  - privatekey optional (default is $HOME/.ssh/id_rsa).
+                       Relative paths are resolved under the testsuite workdir.
+                       Absolute paths must be located under the user's $HOME.
   - sudo optional
   - sudopassword optional (default to password)
+  - insecure_ignore_host_key optional (default false). When false, the server
+                                       host key is verified against
+                                       $HOME/.ssh/known_hosts. Set to true to
+                                       skip verification (insecure).
+  - timeout optional (default 30). Connection timeout, in seconds.
 ```
 
 Example