[maven-pmd-plugin] 01/01: [SECURITY] Fix Partial Path Traversal Vulnerability

[kh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

khmarbaise pushed a commit to branch BulkSecurityGeneratorProjectV2-fix/JLL/partial-path-traversal-vulnerability
in repository https://gitbox.apache.org/repos/asf/maven-pmd-plugin.git

commit b7ba0460683ef4da83678f64eae9c8210a5229e4
Author: Jonathan Leitschuh <Jo...@gmail.com>
AuthorDate: Fri Jul 29 13:38:12 2022 +0000

    [SECURITY] Fix Partial Path Traversal Vulnerability
    
    This fixes a partial path traversal vulnerability.
    
    Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.
    
    To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`.
    The check is bypassed although `/outnot` is not under the `/out` directory.
    It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
    For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
    however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.
    
    Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Severity: Medium
    CVSSS: 6.1
    Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.PartialPathTraversalVulnerability)
    
    Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <Jo...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/13
    
    Co-authored-by: Moderne <te...@moderne.io>
    Signed-off-by: Karl Heinz Marbaise <kh...@apache.org>
---
 src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java b/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
index 7bdd483..a6a5a40 100644
--- a/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
+++ b/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
@@ -491,7 +491,7 @@ public abstract class AbstractPmdReport
         {
             try
             {
-                if ( sourceDirectoryToCheck.getCanonicalPath().startsWith( excludeDir.getCanonicalPath() ) )
+                if ( sourceDirectoryToCheck.getCanonicalFile().toPath().startsWith(excludeDir.getCanonicalFile().toPath()) )
                 {
                     getLog().debug( "Directory " + sourceDirectoryToCheck.getAbsolutePath()
                                         + " has been excluded as it matches excludeRoot "