This is an automated email from the ASF dual-hosted git repository. lhotari pushed a commit to branch branch-4.15 in repository https://gitbox.apache.org/repos/asf/bookkeeper.git
commit 5ff5f10a215741865b75acbf3a11231c8c3bd402 Author: Hang Chen <[email protected]> AuthorDate: Mon Mar 4 12:07:49 2024 +0800 Add filename check for unTar (#4222) * add filename check for unTar * update code (cherry picked from commit 48b7d1ebb1138074356da9790fb20f3219c887a4) --- .../org/apache/bookkeeper/tests/integration/utils/DockerUtils.java | 6 +++++- .../apache/bookkeeper/tests/integration/utils/MavenClassLoader.java | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java index d2a4d731a6..85c0fbb781 100644 --- a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java +++ b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java @@ -137,7 +137,11 @@ public class DockerUtils { TarArchiveEntry entry = stream.getNextTarEntry(); while (entry != null) { if (entry.isFile()) { - File output = new File(getTargetDirectory(containerId), entry.getName().replace("/", "-")); + File targetDir = getTargetDirectory(containerId); + File output = new File(targetDir, entry.getName().replace("/", "-")); + if (!output.toPath().normalize().startsWith(targetDir.toPath())) { + throw new IOException("Bad zip entry"); + } try (FileOutputStream os = new FileOutputStream(output)) { byte[] block = new byte[readBlockSize]; int read = stream.read(block, 0, readBlockSize); diff --git a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java index 32d00370b1..c01593a2db 100644 --- a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java +++ b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java @@ -368,6 +368,10 @@ public class MavenClassLoader implements AutoCloseable { TarArchiveEntry entry; while ((entry = (TarArchiveEntry) debInputStream.getNextEntry()) != null) { final File outputFile = new File(outputDir, entry.getName()); + if (!outputFile.toPath().normalize().startsWith(outputDir.toPath())) { + throw new IOException("Bad zip entry"); + } + if (!outputFile.getParentFile().exists()) { outputFile.getParentFile().mkdirs(); }
