You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ant.apache.org by bo...@apache.org on 2018/07/01 08:37:11 UTC
[2/3] ant git commit: ensure isLeadingPath cannot be subverted by too
many double-dots
ensure isLeadingPath cannot be subverted by too many double-dots
https://bz.apache.org/bugzilla/show_bug.cgi?id=62502
Project: http://git-wip-us.apache.org/repos/asf/ant/repo
Commit: http://git-wip-us.apache.org/repos/asf/ant/commit/d064f5f7
Tree: http://git-wip-us.apache.org/repos/asf/ant/tree/d064f5f7
Diff: http://git-wip-us.apache.org/repos/asf/ant/diff/d064f5f7
Branch: refs/heads/1.9.x
Commit: d064f5f7d3e42026b6c03ce24f403eb9c5ba0a58
Parents: 8cfee71
Author: Stefan Bodewig <bo...@apache.org>
Authored: Sun Jul 1 10:36:21 2018 +0200
Committer: Stefan Bodewig <bo...@apache.org>
Committed: Sun Jul 1 10:36:21 2018 +0200
----------------------------------------------------------------------
src/main/org/apache/tools/ant/util/FileUtils.java | 9 +++++++++
.../junit/org/apache/tools/ant/util/FileUtilsTest.java | 10 ++++++++++
2 files changed, 19 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ant/blob/d064f5f7/src/main/org/apache/tools/ant/util/FileUtils.java
----------------------------------------------------------------------
diff --git a/src/main/org/apache/tools/ant/util/FileUtils.java b/src/main/org/apache/tools/ant/util/FileUtils.java
index 5e5b946..1f3aba5 100644
--- a/src/main/org/apache/tools/ant/util/FileUtils.java
+++ b/src/main/org/apache/tools/ant/util/FileUtils.java
@@ -1182,6 +1182,10 @@ public class FileUtils {
* <p>This method uses {@link #normalize} under the covers and
* does not resolve symbolic links.</p>
*
+ * <p>If either path tries to go beyond the file system root
+ * (i.e. it contains more ".." segments than can be travelled up)
+ * the method will return false.</p>
+ *
* @param leading The leading path, must not be null, must be absolute.
* @param path The path to check, must not be null, must be absolute.
* @return true if path starts with leading; false otherwise.
@@ -1198,6 +1202,11 @@ public class FileUtils {
if (!l.endsWith(File.separator)) {
l += File.separator;
}
+ // ensure "/foo/" is not considered a parent of "/foo/../../bar"
+ String up = File.separator + ".." + File.separator;
+ if (l.contains(up) || p.contains(up) || (p + File.separator).contains(up)) {
+ return false;
+ }
return p.startsWith(l);
}
http://git-wip-us.apache.org/repos/asf/ant/blob/d064f5f7/src/tests/junit/org/apache/tools/ant/util/FileUtilsTest.java
----------------------------------------------------------------------
diff --git a/src/tests/junit/org/apache/tools/ant/util/FileUtilsTest.java b/src/tests/junit/org/apache/tools/ant/util/FileUtilsTest.java
index c520156..0e99f63 100644
--- a/src/tests/junit/org/apache/tools/ant/util/FileUtilsTest.java
+++ b/src/tests/junit/org/apache/tools/ant/util/FileUtilsTest.java
@@ -592,6 +592,16 @@ public class FileUtilsTest {
}
/**
+ * @see "https://bz.apache.org/bugzilla/show_bug.cgi?id=62502"
+ */
+ @Test
+ public void isLeadingPathCannotBeFooledByTooManyDoubleDots() {
+ assertFalse(FILE_UTILS.isLeadingPath(new File("/foo"), new File("/foo/../../bar")));
+ assertFalse(FILE_UTILS.isLeadingPath(new File("c:\\foo"), new File("c:\\foo\\..\\..\\bar")));
+ assertFalse(FILE_UTILS.isLeadingPath(new File("/foo"), new File("/foo/../..")));
+ }
+
+ /**
* adapt file separators to local conventions
*/
private String localize(String path) {