[
https://issues.apache.org/jira/browse/KNOX-2643?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sandor Molnar updated KNOX-2643:
--------------------------------
Fix Version/s: 3.0.0
(was: 2.1.0)
Due to the pending 2.1.0 release this JIRA has been pushed out to 3.0.0 as part
of a bulk update. If there is a specific reason to pull this back into the
2.1.0 release and you intend to provide a PR in the next few days please
provide justification and reset the Fix Version to 2.1.0.
> TopologyService should validate descriptor and provider config file paths
> -------------------------------------------------------------------------
>
> Key: KNOX-2643
> URL: https://issues.apache.org/jira/browse/KNOX-2643
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 1.5.0
> Reporter: Philip Zampino
> Priority: Major
> Fix For: 3.0.0
>
>
> DefaultTopologyService#deployProviderConfiguration andÂ
> DefaultTopologyService#deployDescriptor blindly trust the file name without
> validating that the location will be bound to the expected resource directory
> (e.g., sharedProvidersDirectory, descriptorsDirectory).
> Names that would place the file outside the expected location or intent
> (e.g., ../gateway-site.xml) should be rejected.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
