[maven-pmd-plugin] branch BulkSecurityGeneratorProjectV2-fix/JLL/partial-path-traversal-vulnerability created (now b7ba046)

[kh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

khmarbaise pushed a change to branch BulkSecurityGeneratorProjectV2-fix/JLL/partial-path-traversal-vulnerability
in repository https://gitbox.apache.org/repos/asf/maven-pmd-plugin.git


      at b7ba046  [SECURITY] Fix Partial Path Traversal Vulnerability

This branch includes the following new commits:

     new b7ba046  [SECURITY] Fix Partial Path Traversal Vulnerability

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

[maven-pmd-plugin] 01/01: [SECURITY] Fix Partial Path Traversal Vulnerability

[kh...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

khmarbaise pushed a commit to branch BulkSecurityGeneratorProjectV2-fix/JLL/partial-path-traversal-vulnerability
in repository https://gitbox.apache.org/repos/asf/maven-pmd-plugin.git

commit b7ba0460683ef4da83678f64eae9c8210a5229e4
Author: Jonathan Leitschuh <Jo...@gmail.com>
AuthorDate: Fri Jul 29 13:38:12 2022 +0000

    [SECURITY] Fix Partial Path Traversal Vulnerability
    
    This fixes a partial path traversal vulnerability.
    
    Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`.
    
    To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`.
    The check is bypassed although `/outnot` is not under the `/out` directory.
    It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object.
    For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`;
    however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`.
    
    Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    Severity: Medium
    CVSSS: 6.1
    Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.PartialPathTraversalVulnerability)
    
    Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <Jo...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/13
    
    Co-authored-by: Moderne <te...@moderne.io>
    Signed-off-by: Karl Heinz Marbaise <kh...@apache.org>
---
 src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java b/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
index 7bdd483..a6a5a40 100644
--- a/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
+++ b/src/main/java/org/apache/maven/plugins/pmd/AbstractPmdReport.java
@@ -491,7 +491,7 @@ public abstract class AbstractPmdReport
         {
             try
             {
-                if ( sourceDirectoryToCheck.getCanonicalPath().startsWith( excludeDir.getCanonicalPath() ) )
+                if ( sourceDirectoryToCheck.getCanonicalFile().toPath().startsWith(excludeDir.getCanonicalFile().toPath()) )
                 {
                     getLog().debug( "Directory " + sourceDirectoryToCheck.getAbsolutePath()
                                         + " has been excluded as it matches excludeRoot "