SIGN IN SIGN UP

loader: Block reading of UNC paths

If a UNC path is provided to OPA it won't read it
and instead return an error. This applies to paths
to load bundles and individual data/policy files.

One reason behind blocking UNC paths is they could
trigger a NTLMv2 hash leak. For example, if a SMB share
is provided, OPA will attempt to open it triggering LLMNR
queries which contain the client's NTLMv2 hash which can be cracked
using some tools. This could be exploited by a malicious user.

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
A
Ashutosh Narkar committed
10f4d553e6bb6ae9c69611ecdd9a77dda857070e
Parent: 14ff052