This is an automated email from the ASF dual-hosted git repository.
mandarambawane pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/atlas.git
The following commit(s) were added to refs/heads/master by this push:
new eb0f1ee60 ATLAS-5421 : Prevent /api/atlas/admin/importfile from
reading arbitrary server files and enumerating filesystem paths (#783)
eb0f1ee60 is described below
commit eb0f1ee602e2962398c1490afd461fe7b6654d98
Author: mandarambawane <[email protected]>
AuthorDate: Wed Oct 14 11:48:40 2026 +0530
ATLAS-5421 : Prevent /api/atlas/admin/importfile from reading arbitrary
server files and enumerating filesystem paths (#783)
Co-authored-by: Mandar Ambawane <[email protected]>
---
docs/src/documents/Import-Export/ImportAPI.md | 2 +-
docs/src/documents/Import-Export/ImportAPIOptions.md | 12 +++++++++++-
release-log.txt | 5 +++++
.../atlas/repository/impexp/ImportFilePathValidatorTest.java | 9 +++++++++
4 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/docs/src/documents/Import-Export/ImportAPI.md
b/docs/src/documents/Import-Export/ImportAPI.md
index 0cae7f86f..d06aabbb3 100644
--- a/docs/src/documents/Import-Export/ImportAPI.md
+++ b/docs/src/documents/Import-Export/ImportAPI.md
@@ -42,7 +42,7 @@ The general approach is:
| _Data Parameters_|_None_|
| _Success Response_ | _AtlasImporResult_ is returned as JSON. See details
below.|
|_Error Response_|Errors that are handled within the system will be returned
as _AtlasBaseException_. |
-|_Notes_| The file to be imported needs to be present on the server at the
location specified by the _FILENAME_ parameter.|
+|_Notes_| The file to be imported must be a `.zip` file present under the
configured import directory. Set _atlas.import.allowed.directory_ in
_atlas-application.properties_ (default: `${sys:atlas.data}/import`). The
_fileName_ option must be a relative path under that directory; absolute paths
and path traversal are rejected. All file-access failures return
_IMPORT_FILE_NOT_ACCESSIBLE_ (ATLAS-400-00-10B). Ensure the configured import
directory exists on disk before calling this API.|
__Method Signature for Import__
diff --git a/docs/src/documents/Import-Export/ImportAPIOptions.md
b/docs/src/documents/Import-Export/ImportAPIOptions.md
index d05a680bb..643f56a4d 100644
--- a/docs/src/documents/Import-Export/ImportAPIOptions.md
+++ b/docs/src/documents/Import-Export/ImportAPIOptions.md
@@ -131,12 +131,22 @@ To use the option, set the contents of
_importOptions.json_ to:
In a scenario where the file to be imported is present at a location on the
server, the _importfile_ API can be used. It behaves like the Import API.
+The _fileName_ option must be a relative path to a `.zip` file under the
configured import directory. Absolute paths and path traversal (for example,
`../`) are rejected.
+
+Configure the allowed import directory in _atlas-application.properties_:
+
+<SyntaxHighlighter wrapLines={true} language="properties" style={theme.dark}>
+{`atlas.import.allowed.directory=${sys:atlas.data}/import`}
+</SyntaxHighlighter>
+
+New installations ship with this default. After upgrading, ensure
_atlas.import.allowed.directory_ is set and that the directory exists on disk;
otherwise, _importfile_ requests will fail with _IMPORT_FILE_NOT_ACCESSIBLE_
(ATLAS-400-00-10B).
+
To use the option, set the contents of _importOptions.json_ to:
<SyntaxHighlighter wrapLines={true} language="json" style={theme.dark}>
{`{
"options": {
- "fileName": "/root/fileToBeImported.zip"
+ "fileName": "export.zip"
}
}`}
</SyntaxHighlighter>
diff --git a/release-log.txt b/release-log.txt
index 344f5bfe4..4bfff883d 100644
--- a/release-log.txt
+++ b/release-log.txt
@@ -3,12 +3,17 @@ Apache Atlas Release Notes
--trunk - unreleased
INCOMPATIBLE CHANGES:
+ATLAS-5421: importfile API now returns IMPORT_FILE_NOT_ACCESSIBLE
(ATLAS-400-00-10B) for all file-access failures. Callers that previously relied
on distinct "file not found" or "empty ZIP" errors must update automation that
parses error codes.
ATLAS-675 Storm Hook should use timestamps as Date type instead of Long
(ayubkhan via sumasai)
ATLAS-1122 Change trait edge labels to have trait name alone (sumasai)
ATLAS-1060 Add composite indexes for exact match performance improvements for
all attributes (sumasai via shwethags)
ATLAS-1127 Modify creation and modification timestamps to Date instead of
Long(sumasai)
+CONFIGURATION CHANGES:
+ATLAS-5421: After upgrading, ensure atlas.import.allowed.directory is set. New
installations ship with ${sys:atlas.data}/import. Also ensure the configured
import directory exists on disk; otherwise, importfile will fail.
+
ALL CHANGES:
+ATLAS-5421: Prevent /api/atlas/admin/importfile from reading arbitrary server
files and enumerating filesystem paths
ATLAS-1608 :Search UI improvement (kevalbhatt)
ATLAS-1630: basic search implementation (#2)
ATLAS-1630: basic search implementation using fulltext with support for filter
by type & classification
diff --git
a/repository/src/test/java/org/apache/atlas/repository/impexp/ImportFilePathValidatorTest.java
b/repository/src/test/java/org/apache/atlas/repository/impexp/ImportFilePathValidatorTest.java
index c165e7ebf..a59a640e9 100644
---
a/repository/src/test/java/org/apache/atlas/repository/impexp/ImportFilePathValidatorTest.java
+++
b/repository/src/test/java/org/apache/atlas/repository/impexp/ImportFilePathValidatorTest.java
@@ -121,6 +121,15 @@ public class ImportFilePathValidatorTest {
assertImportFileNotAccessible("export.zip");
}
+ @Test
+ public void validateRejectsWhenAllowedDirectoryDoesNotExist() throws
Exception {
+ File nonExistentDir = new File(importDirectory, "missing-import-dir");
+
ApplicationProperties.get().setProperty(AtlasConfiguration.IMPORT_ALLOWED_DIRECTORY.getPropertyName(),
+ nonExistentDir.getAbsolutePath());
+
+ assertImportFileNotAccessible("export.zip");
+ }
+
@Test
public void validateReturnsSameErrorForMissingAndInvalidFiles() throws
Exception {
File existingFile = new File(importDirectory, "existing.txt");
