[GitHub] [nifi] joewitt commented on a change in pull request #4639: Update PutFile.java: fix path traversal vulnerability

[GitBox <gi...@apache.org>]

joewitt commented on a change in pull request #4639:
URL: https://github.com/apache/nifi/pull/4639#discussion_r516862513



##########
File path: nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/main/java/org/apache/nifi/processors/standard/PutFile.java
##########
@@ -232,8 +240,14 @@ public void onTrigger(final ProcessContext context, final ProcessSession session
             final Path rootDirPath = configuredRootDirPath.toAbsolutePath();
             String filename = flowFile.getAttribute(CoreAttributes.FILENAME.key());
             final Path tempCopyFile = rootDirPath.resolve("." + filename);
-            final Path copyFile = rootDirPath.resolve(filename);
-
+            final Path copyFile = rootDirPath.resolve(filename)
+            if (context.getProperty(PREVENT_PATH_ESCAPE).asBoolean() && !copyFile.startsWith(rootDirPath)) {
+                flowFile = session.penalize(flowFile);
+                session.transfer(flowFile, REL_FAILURE);
+                logger.error("Resolved path escapes the root dir path");

Review comment:
       I would provide the two path values that were compared/tested so the user can understand what really happened. 




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org