gaborgsomogyi opened a new pull request, #28923:
URL: https://github.com/apache/flink/pull/28923
## What is the purpose of the change
`FileCatalogStore.getCatalogPath()` built the on-disk path for a catalog's
configuration file by directly concatenating the caller-supplied `catalogName`
onto `catalogStorePath`, with no validation. Since `Path`'s URI resolution
collapses `..` segments (and discards the base entirely if the child is itself
a scheme-qualified absolute URI), a `catalogName` such as
`../../etc/cron.d/evil` or `file:///etc/passwd` resolves outside of
`catalogStorePath`.
Any caller able to invoke `CREATE CATALOG`, `DROP CATALOG`, or read a
catalog (e.g. via the SQL Gateway) could use this to write, delete, or read
arbitrary files reachable by the Flink process.
This PR rejects any `catalogName` that resolves outside of
`catalogStorePath`, closing the path traversal.
## Brief change log
- `FileCatalogStore#getCatalogPath` now resolves the catalog file path and
verifies its immediate parent is still exactly `catalogStorePath` before
returning it, throwing `CatalogException` otherwise
- Wrapped the `Path` construction itself in a try/catch, since a
scheme-qualified `catalogName` (e.g. `file:///...`) can make `Path`'s own
merge logic throw an unwrapped `IllegalArgumentException`, which is not
part of this class's documented `CatalogException` contract
## Verifying this change
This change added tests and can be verified as follows:
- Added `FileCatalogStoreTest#testStoreCatalogRejectsPathTraversal`, which
uses `catalogName = "../escaped"` and asserts `storeCatalog` throws
`CatalogException` and that no file is created outside of the catalog
store directory. This test fails against the pre-fix code (no exception
is thrown, and the file is written outside the intended directory).
- Added
`FileCatalogStoreTest#testStoreCatalogRejectsAbsoluteSchemeOverride`,
which uses a `catalogName` embedding its own `file://` URI, covering the
scheme-override bypass variant of the same issue.
- All existing tests in `FileCatalogStoreTest` continue to pass.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): no
- The public API, i.e., is any changed class annotated with
`@Public(Evolving)`: no (`FileCatalogStore` is `@Internal`)
- The serializers: no
- The runtime per-record code paths (performance sensitive): no
- Anything that affects deployment or recovery: JobManager (and its
components), Checkpointing, Kubernetes/Yarn, ZooKeeper: no
- The S3 file system connector: no
## Documentation
- Does this pull request introduce a new feature? no
- If yes, how is the feature documented? not applicable
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Code (claude-sonnet-5)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
