You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ant.apache.org by bo...@apache.org on 2026/09/06 18:00:42 UTC
(ant) 05/06: add allowFilesToEscapeDest attribute to FTPTask class
This is an automated email from the ASF dual-hosted git repository.
asf-gitbox-commits pushed a commit to annotated tag ANT_1.10.18_RC1
in repository https://gitbox.apache.org/repos/asf/ant.git
commit 7809cdd503b94b1760eee4145af13655078dc302
Author: Stefan Bodewig <bo...@apache.org>
AuthorDate: Mon Aug 24 19:26:45 2026 +0200
add allowFilesToEscapeDest attribute to FTPTask class
---
.../tools/ant/taskdefs/optional/net/FTPTask.java | 18 ++++++++++++++++++
.../ant/taskdefs/optional/net/FTPTaskMirrorImpl.java | 12 ++++++++++--
2 files changed, 28 insertions(+), 2 deletions(-)
diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java
index 6d2e73923..72cdd011b 100644
--- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java
+++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java
@@ -103,6 +103,7 @@ public class FTPTask extends Task implements FTPTaskConfig {
private String siteCommand = null;
private String initialSiteCommand = null;
private boolean enableRemoteVerification = true;
+ private boolean allowFilesToEscapeDest = false;
private Path classpath;
private ClassLoader mirrorLoader;
@@ -728,6 +729,23 @@ public class FTPTask extends Task implements FTPTaskConfig {
return enableRemoteVerification;
}
+ /**
+ * Whether to allow the retrieved files or directories to be outside of the dest directory.
+ *
+ * @param b the flag
+ * @since Ant 1.10.18
+ */
+ public void setAllowFilesToEscapeDest(boolean b) {
+ allowFilesToEscapeDest = b;
+ }
+
+ /**
+ * @since Ant 1.10.18
+ */
+ public boolean getAllowFilesToEscapeDest() {
+ return allowFilesToEscapeDest;
+ }
+
/**
* Checks to see that all required parameters are set.
*
diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java
index 77816de24..139706e57 100644
--- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java
+++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java
@@ -1632,10 +1632,18 @@ public class FTPTaskMirrorImpl implements FTPTaskMirror {
*/
protected void getFile(FTPClient ftp, String dir, String filename)
throws IOException, BuildException {
+ File baseDir = task.getProject().resolveFile(dir);
+ File file = FILE_UTILS.resolveFile(baseDir, filename);
+ if (!task.getAllowFilesToEscapeDest()
+ && !FILE_UTILS.isLeadingPath(baseDir, file, true)) {
+ task.log("skipping " + filename + " as its target " + FILE_UTILS.getResolvedPath(file)
+ + " is outside of " + FILE_UTILS.getResolvedPath(baseDir) + ".", Project.MSG_WARN);
+ skipped++;
+ return;
+ }
+
OutputStream outstream = null;
try {
- File file = task.getProject().resolveFile(new File(dir, filename).getPath());
-
if (task.isNewer() && isUpToDate(ftp, file, resolveFile(filename))) {
return;
}