You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iotdb.apache.org by ji...@apache.org on 2025/08/05 01:58:35 UTC
(iotdb) branch fix_path_attack_when_loading_iot_snapshot created (now f907bd3eb07)
This is an automated email from the ASF dual-hosted git repository.
jiangtian pushed a change to branch fix_path_attack_when_loading_iot_snapshot
in repository https://gitbox.apache.org/repos/asf/iotdb.git
at f907bd3eb07 Fix path attack when loading snapshot of IoTConsensus
This branch includes the following new commits:
new f907bd3eb07 Fix path attack when loading snapshot of IoTConsensus
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(iotdb) 01/01: Fix path attack when loading snapshot of IoTConsensus
Posted by ji...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jiangtian pushed a commit to branch fix_path_attack_when_loading_iot_snapshot
in repository https://gitbox.apache.org/repos/asf/iotdb.git
commit f907bd3eb07523ec40eb0079c8601d961b07b184
Author: Tian Jiang <jt...@163.com>
AuthorDate: Tue Aug 5 09:58:09 2025 +0800
Fix path attack when loading snapshot of IoTConsensus
---
.../consensus/iot/IoTConsensusServerImpl.java | 22 +++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/IoTConsensusServerImpl.java b/iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/IoTConsensusServerImpl.java
index 9c46ba9b7a6..b6dc93ab74d 100644
--- a/iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/IoTConsensusServerImpl.java
+++ b/iotdb-core/consensus/src/main/java/org/apache/iotdb/consensus/iot/IoTConsensusServerImpl.java
@@ -361,7 +361,7 @@ public class IoTConsensusServerImpl {
throws ConsensusGroupModifyPeerException {
try {
String targetFilePath = calculateSnapshotPath(snapshotId, originalFilePath);
- File targetFile = new File(storageDir, targetFilePath);
+ File targetFile = getSnapshotPath(targetFilePath);
Path parentDir = Paths.get(targetFile.getParent());
if (!Files.exists(parentDir)) {
Files.createDirectories(parentDir);
@@ -408,7 +408,23 @@ public class IoTConsensusServerImpl {
public void loadSnapshot(String snapshotId) {
// TODO: (xingtanzjr) throw exception if the snapshot load failed
- stateMachine.loadSnapshot(new File(storageDir, snapshotId));
+ stateMachine.loadSnapshot(getSnapshotPath(snapshotId));
+ }
+
+ private File getSnapshotPath(String snapshotRelativePath) {
+ File storageDirFile = new File(storageDir);
+ File snapshotDir = new File(storageDir, snapshotRelativePath);
+ try {
+ if (!snapshotDir
+ .getCanonicalFile()
+ .toPath()
+ .startsWith(storageDirFile.getCanonicalFile().toPath())) {
+ throw new IllegalArgumentException("Invalid snapshotRelativePath: " + snapshotRelativePath);
+ }
+ } catch (IOException e) {
+ throw new IllegalArgumentException(e);
+ }
+ return snapshotDir;
}
@FunctionalInterface
@@ -823,7 +839,7 @@ public class IoTConsensusServerImpl {
}
public void cleanupSnapshot(String snapshotId) throws ConsensusGroupModifyPeerException {
- File snapshotDir = new File(storageDir, snapshotId);
+ File snapshotDir = getSnapshotPath(snapshotId);
if (snapshotDir.exists()) {
try {
FileUtils.deleteDirectory(snapshotDir);