Merge pull request #360 from lunasec-io/do-not-open-non-existant-files-from-symlinks

Broken symlinks no longer stop scanning

Former-commit-id: 998c69d
Former-commit-id: 01e330a42371d858afe52ceae45107d51270c496

Author: breadchris

tools/log4shell/constants/version.go

@@ -14,4 +14,4 @@
 //
 package constants
 
-const Version = "1.4.0"
+const Version = "1.4.1"

tools/log4shell/scan/scan.go

@@ -90,7 +90,7 @@ func (s *Log4jDirectoryScanner) Scan(
 			// overwrite path and info with the resolved symlink file values
 			path, info, err = util.ResolveSymlinkFilePathAndInfo(path)
 			if err != nil {
-				return
+				return nil
 			}
 		}
 

tools/log4shell/test/vulnerable-log4j2-versions/not-jars/non-existing-symlink.jar

@@ -0,0 +1 @@
+a

tools/log4shell/util/fs.go

@@ -47,12 +47,22 @@ func ResolveSymlinkFilePathAndInfo(symlinkPath string) (path string, info os.Fil
 	path, err = filepath.EvalSymlinks(symlinkPath)
 	if err != nil {
 		log.Warn().
-			Str("path", path).
+			Str("symlinkPath", symlinkPath).
 			Err(err).
 			Msg("unable to read symlink to file")
 		return
 	}
 
+	_, err = os.Stat(path)
+	if err != nil {
+		log.Warn().
+			Str("path", path).
+			Str("symlinkPath", symlinkPath).
+			Err(err).
+			Msg("unable to read evaluated path")
+		return
+	}
+
 	// use file info of the resolved file
 	info, err = os.Lstat(path)
 	if err != nil {