{{ message }}
Repository navigation
Prevent partial path traversal in untar. - #7985
Merged
Merged
Conversation
The `File.getCanonicalPath` method transforms the path into a canonical form preventing such attack types as `..` in path
segments. If the result of `outputDir.getCanonicalPath()` is not slash terminated it allows for partial path
traversal.
Consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although it is not the
out directory. The terminating slash may be removed in various places. On Linux `println(new
File("/var/"))` returns /var, but `println(new File("/var", "/"))` - `/var/`, however `println(new
File("/var", "/").getCanonicalPath())` - `/var`
mayankshriv
force-pushed
the
security-fix
branch
from
January 9, 2022 18:40
42165a8 to
b336b94
Compare
richardstartin
approved these changes
Jan 9, 2022
siddharthteotia
approved these changes
Jan 9, 2022
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
File.getCanonicalPathmethod transforms the path into a canonical form preventing such attack types as..in pathsegments. If the result of
outputDir.getCanonicalPath()is not slash terminated it allows for partial pathtraversal.
Consider
"/usr/outnot".startsWith("/usr/out"). The check is bypassed although it is not theout directory. The terminating slash may be removed in various places. On Linux
println(new File("/var/"))returns /var, butprintln(new File("/var", "/"))-/var/, howeverprintln(new File("/var", "/").getCanonicalPath())-/varDescription
Upgrade Notes
Does this PR prevent a zero down-time upgrade? (Assume upgrade order: Controller, Broker, Server, Minion)
backward-incompat, and complete the section below on Release Notes)Does this PR fix a zero-downtime upgrade introduced earlier?
backward-incompat, and complete the section below on Release Notes)Does this PR otherwise need attention when creating release notes? Things to consider:
release-notesand complete the section on Release Notes)Release Notes
Documentation