Currently RAT accepts a file name from any location as an argument parameter. For example, the file argument to the RAT configuration file can be outside the tree being scanned.
We can easily change to restricting the input file to within the directory tree from where RAT was executed. The advantage is that it locks down security. I do note however that our security doc indicates that the security attack surface does not include user provided configuration files. The disadvantage is that it prohibits storing the configuration files outside the scope of the tree(s) being scanned. I originally thought that it should be locked down, but now I am not certain, and am tendering back to not locking it down. Thoughts? -- LinkedIn: http://www.linkedin.com/in/claudewarren
