This is an automated email from the ASF dual-hosted git repository. coheigea pushed a commit to branch coheigea/xml2fastinfoset in repository https://gitbox.apache.org/repos/asf/cxf-build-utils.git
commit eff200e77cacd64f95cb9df6a3875335a6db43b9 Author: Colm O hEigeartaigh <[email protected]> AuthorDate: Fri Oct 9 08:14:44 2026 +0100 Keep xml2fastinfoset input and output within their directories --- .../xml2fastinfoset/XML2FastInfosetCompilerMojo.java | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/xml2fastinfoset-plugin/src/main/java/org/apache/cxf/maven_plugin/xml2fastinfoset/XML2FastInfosetCompilerMojo.java b/xml2fastinfoset-plugin/src/main/java/org/apache/cxf/maven_plugin/xml2fastinfoset/XML2FastInfosetCompilerMojo.java index 10928eb..dcbdc7d 100644 --- a/xml2fastinfoset-plugin/src/main/java/org/apache/cxf/maven_plugin/xml2fastinfoset/XML2FastInfosetCompilerMojo.java +++ b/xml2fastinfoset-plugin/src/main/java/org/apache/cxf/maven_plugin/xml2fastinfoset/XML2FastInfosetCompilerMojo.java @@ -161,13 +161,18 @@ public class XML2FastInfosetCompilerMojo extends AbstractMojo { String destination = name.replaceFirst("\\.xml$", ".fixml"); if (targetPath != null) { - destination = targetPath + "/" + name; + destination = targetPath + "/" + destination; } File source = new File(resourceDirectory, name); File destinationFile = new File(outputDirectory, destination); + // Don't follow symbolic links out of the resource directory, and don't write + // outside of the output directory + checkWithin(source, resourceDirectory); + checkWithin(destinationFile, outputDirectory); + if (!destinationFile.getParentFile().exists()) { destinationFile.getParentFile().mkdirs(); } @@ -183,6 +188,16 @@ public class XML2FastInfosetCompilerMojo extends AbstractMojo { } } + private static void checkWithin(File file, File directory) throws MojoExecutionException { + try { + if (!file.getCanonicalFile().toPath().startsWith(directory.getCanonicalFile().toPath())) { + throw new MojoExecutionException(file + " resolves to a location outside of " + directory); + } + } catch (IOException e) { + throw new MojoExecutionException("Cannot resolve the canonical path of " + file, e); + } + } + private void compileFile(File sourceFile, File destinationFile) throws ParserConfigurationException, SAXException, IOException {
