[GitHub] [lucene-solr] janhoy commented on a change in pull request #1572: SOLR-14561 CoreAdminAPI's parameters instanceDir and dataDir are now validated

[GitBox <gi...@apache.org>]

janhoy commented on a change in pull request #1572:
URL: https://github.com/apache/lucene-solr/pull/1572#discussion_r439730789



##########
File path: solr/core/src/java/org/apache/solr/core/CoreContainer.java
##########
@@ -1259,6 +1277,20 @@ public SolrCore create(String coreName, Path instancePath, Map<String, String> p
     }
   }
 
+  /**
+   * Checks that the given path is relative to SOLR_HOME, SOLR_DATA_HOME, coreRootDirectory or one of the paths
+   * specified in solr.xml's allowPaths element.
+   * @param path path to check
+   * @throws SolrException if path is outside allowed paths
+   */
+  public void assertPathAllowed(Path path) throws SolrException {
+    if (path.normalize().equals(path) && !path.isAbsolute()) return;

Review comment:
       You are right. We need a more thorough check
   * Disallow relative paths starting with "."
   * Always `normalize()` the path before `toAbsolutePath()` to catch the `/var/solr/../../etc` case, else that example would return true for `startsWith("/var/solr")`




----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@lucene.apache.org
For additional commands, e-mail: issues-help@lucene.apache.org