loader: Block reading of UNC paths
If a UNC path is provided to OPA it won't read it and instead return an error. This applies to paths to load bundles and individual data/policy files. One reason behind blocking UNC paths is they could trigger a NTLMv2 hash leak. For example, if a SMB share is provided, OPA will attempt to open it triggering LLMNR queries which contain the client's NTLMv2 hash which can be cracked using some tools. This could be exploited by a malicious user. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
A
Ashutosh Narkar committed
10f4d553e6bb6ae9c69611ecdd9a77dda857070e
Parent: 14ff052