jbonofre opened a new pull request, #2867:
URL: https://github.com/apache/karaf/pull/2867
## Motivation
`ConfigRepositoryImpl` builds the file it persists a configuration to from
caller-supplied input and never checks that the result stays inside
`${karaf.etc}`:
- a `felix.fileinstall.filename` entry in the property map is turned into a
`File` as-is (`getCfgFileFromProperty`), so it can point anywhere;
- the PID (and the factory alias) are concatenated verbatim into the file
name (`generateConfigFilename`, `createFactoryConfiguration`), so a name
containing `..` segments resolves outside the folder.
These paths are reachable from the `config` MBean and the `config:*` shell
commands. `ConfigMBeanImpl.install()` and the `config:install` command already
tried to guard against this, but only with a `finalname.contains("..")` string
test, which does not cover absolute paths or symlinks.
## Changes
- New `org.apache.karaf.util.PathUtils` with `isWithin(parent, child)` /
`checkWithin(parent, child)`, doing an element-wise `startsWith` comparison on
canonical paths.
- `ConfigRepositoryImpl.update()` and `createFactoryConfiguration()` now
verify the target file is inside `${karaf.etc}` before writing. The branch that
reuses an already-persisted `felix.fileinstall.filename` coming from
Configuration Admin is left untouched so multi-directory Felix FileInstall
setups keep working.
- `ConfigMBeanImpl.install()` and `InstallCommand` (`config:install`) use
`PathUtils.checkWithin(...)` instead of the `contains("..")` check.
- Tests: `PathUtilsTest`, `ConfigRepositoryImplContainmentTest`.
`ConfigMBeanImplTest.testInstallWithNonAuthorizePath` now expects
`MBeanException` (the rejection is raised inside the method's existing `try`).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
