You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ranger.apache.org by co...@apache.org on 2017/05/09 13:50:58 UTC
[1/2] ranger git commit: RANGER-1450 - Avoid path traversal attacks
when reading XML files
Repository: ranger
Updated Branches:
refs/heads/master c324ece11 -> 7019d3c6b
RANGER-1450 - Avoid path traversal attacks when reading XML files
Signed-off-by: Colm O hEigeartaigh <co...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/ranger/commit/79da7d92
Tree: http://git-wip-us.apache.org/repos/asf/ranger/tree/79da7d92
Diff: http://git-wip-us.apache.org/repos/asf/ranger/diff/79da7d92
Branch: refs/heads/master
Commit: 79da7d92721bb48b6fe96444cfb2c801a524a8a7
Parents: c324ece
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Mon Mar 13 10:37:41 2017 +0000
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Tue May 9 14:20:30 2017 +0100
----------------------------------------------------------------------
.../src/main/java/org/apache/ranger/plugin/util/XMLUtils.java | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ranger/blob/79da7d92/agents-common/src/main/java/org/apache/ranger/plugin/util/XMLUtils.java
----------------------------------------------------------------------
diff --git a/agents-common/src/main/java/org/apache/ranger/plugin/util/XMLUtils.java b/agents-common/src/main/java/org/apache/ranger/plugin/util/XMLUtils.java
index 5eb61ab..3b674f8 100644
--- a/agents-common/src/main/java/org/apache/ranger/plugin/util/XMLUtils.java
+++ b/agents-common/src/main/java/org/apache/ranger/plugin/util/XMLUtils.java
@@ -103,7 +103,12 @@ public class XMLUtils {
InputStream ret = null;
- File f = new File(path);
+ // Guard against path traversal attacks
+ String sanitizedPath = new File(path).getName();
+ if ("".equals(sanitizedPath)) {
+ return null;
+ }
+ File f = new File(sanitizedPath);
if (f.exists()) {
ret = new FileInputStream(f);
[2/2] ranger git commit: RANGER-1528 - Update Maven jar plugin
Posted by co...@apache.org.
RANGER-1528 - Update Maven jar plugin
Signed-off-by: Colm O hEigeartaigh <co...@apache.org>
Project: http://git-wip-us.apache.org/repos/asf/ranger/repo
Commit: http://git-wip-us.apache.org/repos/asf/ranger/commit/7019d3c6
Tree: http://git-wip-us.apache.org/repos/asf/ranger/tree/7019d3c6
Diff: http://git-wip-us.apache.org/repos/asf/ranger/diff/7019d3c6
Branch: refs/heads/master
Commit: 7019d3c6b5d5abeaee3d823dfa4bc4c3927474ef
Parents: 79da7d9
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Thu Apr 20 10:30:01 2017 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Tue May 9 14:21:12 2017 +0100
----------------------------------------------------------------------
pom.xml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/ranger/blob/7019d3c6/pom.xml
----------------------------------------------------------------------
diff --git a/pom.xml b/pom.xml
index 70ab89e..e2a0f92 100644
--- a/pom.xml
+++ b/pom.xml
@@ -422,7 +422,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
- <version>2.6</version>
+ <version>3.0.2</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>