Eduardo Aguinaga created CASSANDRA-12328:
--------------------------------------------
Summary: Path Manipulation
Key: CASSANDRA-12328
URL: https://issues.apache.org/jira/browse/CASSANDRA-12328
Project: Cassandra
Issue Type: Bug
Reporter: Eduardo Aguinaga
Fix For: 3.0.5
Overview:
In May through June of 2016 a static analysis was performed on version 3.0.5 of
the Cassandra source code. The analysis included an automated analysis using HP
Fortify v4.21 SCA and a manual analysis utilizing SciTools Understand v4. The
results of that analysis includes the issue below.
Issue:
There are several places in the Cassandra source code where a string that
determines the path of a file is not examined prior to use. Path traversal
vulnerabilities are common software security problems and failure to validate
the path prior to open/creating a file may result in operating in a directory
that is outside the intended control sphere.
Path manipulation issues were found in the following locations:
CompactionManager.java Line 637
Descriptor.java Line 224
MetadataSerializer.java Line 83
The following snippet is from CompactionManager.java where unvalidated input is
parsed and used to create a new File object on line 637:
{code:java}
CompactionManager.java, lines 621-638:
621 public void forceUserDefinedCompaction(String dataFiles)
622 {
623 String[] filenames = dataFiles.split(",");
624 Multimap<ColumnFamilyStore, Descriptor> descriptors =
ArrayListMultimap.create();
625
626 for (String filename : filenames)
627 {
628 // extract keyspace and columnfamily name from filename
629 Descriptor desc = Descriptor.fromFilename(filename.trim());
630 if (Schema.instance.getCFMetaData(desc) == null)
631 {
632 logger.warn("Schema does not exist for file {}. Skipping.",
filename);
633 continue;
634 }
635 // group by keyspace/columnfamily
636 ColumnFamilyStore cfs =
Keyspace.open(desc.ksname).getColumnFamilyStore(desc.cfname);
637 descriptors.put(cfs, cfs.getDirectories().find(new
File(filename.trim()).getName()));
638 }
{code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
