[I] Path traversal via bundle descriptor resource names (CWE-22) [maven-remote-resources-plugin]

["elharo (via GitHub)" <gi...@apache.org>]

elharo opened a new issue, #265:
URL: https://github.com/apache/maven-remote-resources-plugin/issues/265

   ## Summary
   `AbstractProcessRemoteResourcesMojo.processResourceBundles()` builds the output file path directly from a remote bundle descriptor entry and writes into it without validating or normalizing the name:
   
   ```java
   File outputFile = new File(outputDirectory, projectResource);
   FileUtils.mkdir(outputFile.getParentFile().getAbsolutePath());
   ...
   URL bundleResourceUrl = classLoader.getResource(bundleResource);
   if (bundleResourceUrl != null) {
       FileUtils.copyURLToFile(bundleResourceUrl, outputFile);
   }
   ```
   
   `src/main/java/org/apache/maven/plugin/resources/remote/AbstractProcessRemoteResourcesMojo.java:936-963`
   
   ## Problems
   1. `new File(parent, child)` silently ignores `parent` when `child` is absolute, so an absolute `<remoteResource>/etc/...</remoteResource>` in the descriptor targets an arbitrary path.
   2. `..` segments in the descriptor entry escape the output directory.
   
   ## Impact
   Content writes are partially constrained: non-`.vm` resources are only copied when `classLoader.getResource(name)` resolves the same (traversal) name, which usually fails. However:
   - `FileUtils.mkdir(outputFile.getParentFile()...)` runs unconditionally before that check (`:938`), so an untrusted bundle can create directories anywhere the build user can write.
   - The local-override copy path `copyResourceIfExists()` (`:614-664`) writes local project files to the traversal-resolved target, so a file outside the output directory can be overwritten when the layout lines up.
   - The `.vm` path uses the same unsanitized name for `velocity.mergeTemplate(...)`.
   
   A malicious/third-party bundle can create arbitrary directories (and, in the override case, overwrite files) outside the configured output directory.
   
   ## Suggested fix
   Validate/denormalize resource names before use: reject names containing `..`, leading `/`, backslashes, or drive letters; or resolve `new File(outputDirectory, name)` and verify it stays inside `outputDirectory` before `mkdir`/copy.
   
   ## Note
   See also `copyProjectRootIfExists()` (`:666-679`) and `copyResourceIfExists()` (`:614-664`) which use the same unsanitized `bundleResourceName`/`projectResource` to derive source files.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Path traversal via bundle descriptor resource names (CWE-22) [maven-remote-resources-plugin]

["slachiewicz (via GitHub)" <gi...@apache.org>]

slachiewicz closed issue #265: Path traversal via bundle descriptor resource names (CWE-22)
URL: https://github.com/apache/maven-remote-resources-plugin/issues/265


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org