(openmeetings) branch master updated: [OPENMEETINGS-2829] OmUser pictureUri is properly validated

[solomax]

This is an automated email from the ASF dual-hosted git repository.

solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git


The following commit(s) were added to refs/heads/master by this push:
     new 374414fc2 [OPENMEETINGS-2829] OmUser pictureUri is properly validated
374414fc2 is described below

commit 374414fc21443408a028fa2d13a71195bb8afcdf
Author: Maxim Solodovnik <solo...@apache.org>
AuthorDate: Wed Aug 26 22:45:21 2026 +0700

    [OPENMEETINGS-2829] OmUser pictureUri is properly validated
---
 .../java/org/apache/openmeetings/util/OmFileHelper.java   | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git 
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
 
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
index 3b813b382..64f9cda0a 100644
--- 
a/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
+++ 
b/openmeetings-util/src/main/java/org/apache/openmeetings/util/OmFileHelper.java
@@ -178,7 +178,8 @@ public class OmFileHelper {
                if (SIP_USER_ID.equals(userId)) {
                        img = new File(getImagesDir(), SIP_PICTURE_URI);
                } else if (userId != null) {
-                       img = new File(getUploadProfilesUserDir(userId), uri == 
null ? "" : uri);
+                       File dir = getUploadProfilesUserDir(userId);
+                       img = validateLocation(uri == null ? "" : uri, dir, 
false);
                }
                if (img == null || !img.exists() || img.isDirectory()) {
                        img = def;
@@ -400,14 +401,22 @@ public class OmFileHelper {
        }
 
        public static File validateLocation(String ename, String intended) {
-               return validateLocation(ename, new File(intended));
+               return validateLocation(ename, new File(intended), true);
        }
 
        public static File validateLocation(String ename, File intended) {
+               return validateLocation(ename, intended, true);
+       }
+
+       public static File validateLocation(String ename, File intended, 
boolean fail) {
                Path base = intended.toPath();
                Path res = base.resolve(ename).normalize();
                if (!res.startsWith(base)) {
-                       throw new IllegalStateException("File is outside 
extraction target directory.");
+                       if (fail) {
+                               throw new IllegalStateException("File is 
outside extraction target directory.");
+                       } else {
+                               return null;
+                       }
                }
                return res.toFile();
        }