This is an automated email from the ASF dual-hosted git repository. tjwatson pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/felix-atomos.git
The following commit(s) were added to refs/heads/master by this push: new 7169b71 Fix case where directory content lookup can break out new a59b561 Merge pull request #49 from tjwatson/fixContentBreakOut 7169b71 is described below commit 7169b7197041da8335c6e11effec3467a8ec7405 Author: Thomas Watson <tjwat...@us.ibm.com> AuthorDate: Thu Jan 13 08:39:17 2022 -0600 Fix case where directory content lookup can break out --- .../atomos/impl/content/ConnectContentFile.java | 34 +++++++++++----- .../impl/content/ConnectContentFileTest.java | 46 ++++++++++++++++++++++ 2 files changed, 71 insertions(+), 9 deletions(-) diff --git a/atomos/src/main/java/org/apache/felix/atomos/impl/content/ConnectContentFile.java b/atomos/src/main/java/org/apache/felix/atomos/impl/content/ConnectContentFile.java index 5194505..6c9a7d3 100644 --- a/atomos/src/main/java/org/apache/felix/atomos/impl/content/ConnectContentFile.java +++ b/atomos/src/main/java/org/apache/felix/atomos/impl/content/ConnectContentFile.java @@ -136,21 +136,37 @@ public class ConnectContentFile implements ConnectContent { return Optional.empty(); } - if (path.contains(POINTER_UPPER_DIRECTORY)) + if (path.contains(POINTER_UPPER_DIRECTORY) && !isInContent(file)) { - try + return Optional.empty(); + } + return Optional.of(file); + } + + boolean isInContent(File file) + { + try + { + String canonicalizedRoot = root.getCanonicalPath(); + if (!canonicalizedRoot.endsWith(File.separator)) { - if (!file.getCanonicalPath().startsWith(root.getCanonicalPath())) - { - return Optional.empty(); - } + canonicalizedRoot += File.separator; + } + String canonicalizedChild = file.getCanonicalPath(); + if (file.isDirectory() && !canonicalizedChild.endsWith(File.separator)) + { + canonicalizedChild += File.separator; } - catch (IOException e) + if (!canonicalizedChild.startsWith(canonicalizedRoot)) { - return Optional.empty(); + return false; } } - return Optional.of(file); + catch (IOException e) + { + return false; + } + return true; } @Override diff --git a/atomos/src/test/java/org/apache/felix/atomos/impl/content/ConnectContentFileTest.java b/atomos/src/test/java/org/apache/felix/atomos/impl/content/ConnectContentFileTest.java new file mode 100644 index 0000000..8476ed3 --- /dev/null +++ b/atomos/src/test/java/org/apache/felix/atomos/impl/content/ConnectContentFileTest.java @@ -0,0 +1,46 @@ +/* + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.felix.atomos.impl.content; + +import static org.junit.jupiter.api.Assertions.assertTrue; + +import java.io.IOException; +import java.nio.file.Files; +import java.nio.file.Path; +import java.util.Optional; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.io.TempDir; +import org.osgi.framework.connect.ConnectContent; +import org.osgi.framework.connect.ConnectContent.ConnectEntry; + +public class ConnectContentFileTest +{ + @Test + void testBreakout(@TempDir Path tmpDir) throws IOException + { + Files.createDirectories(tmpDir); + Path content1 = tmpDir.resolve("testcontent"); + Path content2 = tmpDir.resolve("testcontentbreakout"); + Files.createDirectory(content1); + Files.createDirectory(content2); + Path file = content2.resolve("file"); + Files.createFile(file); + ConnectContent connectContent = new ConnectContentFile(content1.toFile(), + Optional::empty); + Optional<ConnectEntry> entry = connectContent.getEntry( + "../testcontentbreakout/file"); + assertTrue(entry.isEmpty(), "Found unexpected entry."); + } +}