This is an automated email from the ASF dual-hosted git repository.
solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git
The following commit(s) were added to refs/heads/master by this push:
new 6653a51df [OPENMEETINGS-2821] proper file checks are implemented
6653a51df is described below
commit 6653a51df7aa24995e1dc74e3ba69f7b82c3a4f6
Author: Maxim Solodovnik <[email protected]>
AuthorDate: Sun May 31 14:30:58 2026 +0700
[OPENMEETINGS-2821] proper file checks are implemented
---
.../org/apache/openmeetings/backup/BackupImport.java | 16 ++--------------
.../java/org/apache/openmeetings/util/OmFileHelper.java | 13 +++++++++++++
.../java/org/apache/openmeetings/web/room/RoomPanel.java | 6 +++---
3 files changed, 18 insertions(+), 17 deletions(-)
diff --git
a/openmeetings-install/src/main/java/org/apache/openmeetings/backup/BackupImport.java
b/openmeetings-install/src/main/java/org/apache/openmeetings/backup/BackupImport.java
index cafffbaef..8786b1445 100644
---
a/openmeetings-install/src/main/java/org/apache/openmeetings/backup/BackupImport.java
+++
b/openmeetings-install/src/main/java/org/apache/openmeetings/backup/BackupImport.java
@@ -89,6 +89,7 @@ import static
org.apache.openmeetings.util.OmFileHelper.getStreamsHibernateDir;
import static org.apache.openmeetings.util.OmFileHelper.getUploadFilesDir;
import static
org.apache.openmeetings.util.OmFileHelper.getUploadProfilesUserDir;
import static org.apache.openmeetings.util.OmFileHelper.getUploadWmlDir;
+import static org.apache.openmeetings.util.OmFileHelper.validateLocation;
import static
org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_APPOINTMENT_REMINDER_MINUTES;
import static
org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_CALENDAR_ROOM_CAPACITY;
import static
org.apache.openmeetings.util.OpenmeetingsVariables.CONFIG_CAM_FPS;
@@ -376,19 +377,6 @@ public class BackupImport {
private final Map<String, String> fileMap = new HashMap<>();
private final Map<String, String> hashMap = new HashMap<>();
- private static File validate(String ename, File intended) throws
IOException {
- final String intendedPath = intended.getCanonicalPath();
- // for each entry to be extracted
- File fentry = new File(intended, ename);
- final String canonicalPath = fentry.getCanonicalPath();
-
- if (canonicalPath.startsWith(intendedPath)) {
- return fentry;
- } else {
- throw new IllegalStateException("File is outside
extraction target directory.");
- }
- }
-
private static File unzip(InputStream is) throws IOException {
File f =
OmFileHelper.getNewDir(OmFileHelper.getUploadImportDir(),
randomUUID().toString());
log.debug("##### EXTRACTING BACKUP TO: {}", f);
@@ -397,7 +385,7 @@ public class BackupImport {
ZipEntry zipentry = null;
while ((zipentry = zis.getNextEntry()) != null) {
// for each entry to be extracted
- File fentry = validate(zipentry.getName(), f);
+ File fentry =
validateLocation(zipentry.getName(), f);
File dir = zipentry.isDirectory() ? fentry :
fentry.getParentFile();
if (!dir.exists() && !dir.mkdirs()) {
log.warn("Failed to create folders:
{}", dir);
diff --git
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
index a8588b677..3b813b382 100644
---
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
+++
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
@@ -398,4 +398,17 @@ public class OmFileHelper {
int dotidx = name.lastIndexOf('.');
return dotidx < 0 ? "" : name.substring(dotidx +
1).toLowerCase(Locale.ROOT);
}
+
+ public static File validateLocation(String ename, String intended) {
+ return validateLocation(ename, new File(intended));
+ }
+
+ public static File validateLocation(String ename, File intended) {
+ Path base = intended.toPath();
+ Path res = base.resolve(ename).normalize();
+ if (!res.startsWith(base)) {
+ throw new IllegalStateException("File is outside
extraction target directory.");
+ }
+ return res.toFile();
+ }
}
diff --git
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/room/RoomPanel.java
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/room/RoomPanel.java
index d67cb3a8d..fdbd6f8b7 100644
---
a/openmeetings-web/src/main/java/org/apache/openmeetings/web/room/RoomPanel.java
+++
b/openmeetings-web/src/main/java/org/apache/openmeetings/web/room/RoomPanel.java
@@ -26,10 +26,10 @@ import static
org.apache.openmeetings.web.app.WebSession.getDateFormat;
import static org.apache.openmeetings.web.app.WebSession.getUserId;
import static org.apache.openmeetings.web.room.VideoSettings.VIDEO_SETTINGS_JS;
import static org.apache.openmeetings.util.OmFileHelper.EXTENSION_PDF;
+import static org.apache.openmeetings.util.OmFileHelper.validateLocation;
import java.io.IOException;
import java.nio.file.Files;
-import java.nio.file.Paths;
import java.util.Calendar;
import java.util.List;
import java.util.Map.Entry;
@@ -237,7 +237,7 @@ public class RoomPanel extends BasePanel {
@Override
protected IResourceStream getResourceStream(Attributes
attributes) {
setFileName(EXTENSION_PDF.equals(ftype) ?
"whiteboard.pdf" : "slide.png");
- return new
FileResourceStream(Paths.get(System.getProperty("java.io.tmpdir"),
fuid).toFile());
+ return new FileResourceStream(validateLocation(fuid,
System.getProperty("java.io.tmpdir")));
}
}) {
private static final long serialVersionUID = 1L;
@@ -246,7 +246,7 @@ public class RoomPanel extends BasePanel {
protected void onDownloadCompleted(AjaxRequestTarget target) {
super.onDownloadCompleted(target);
try {
-
Files.deleteIfExists(Paths.get(System.getProperty("java.io.tmpdir"), fuid));
+ Files.deleteIfExists(validateLocation(fuid,
System.getProperty("java.io.tmpdir")).toPath());
} catch (Exception e) {
log.error("unexcepted error while clean-up", e);
}
