[
https://issues.apache.org/jira/browse/TEZ-4699?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ramit Gupta updated TEZ-4699:
-----------------------------
Description:
{code:java}
public void dumpToFile(String fileName) throws IOException {
OutputStreamWriter writer = new OutputStreamWriter(
new FileOutputStream(new File(fileName)),
Charset.forName("UTF-8").newEncoder());{code}
this part is exploitable as without any validation and canonical checks it is
opened for writing which should be avoided for a public method
> Add Validation/Canonical checks to avoid path exploitation in CSVResult.java
> ----------------------------------------------------------------------------
>
> Key: TEZ-4699
> URL: https://issues.apache.org/jira/browse/TEZ-4699
> Project: Apache Tez
> Issue Type: Improvement
> Reporter: Ramit Gupta
> Assignee: Ramit Gupta
> Priority: Major
>
> {code:java}
> public void dumpToFile(String fileName) throws IOException {
> OutputStreamWriter writer = new OutputStreamWriter(
> new FileOutputStream(new File(fileName)),
> Charset.forName("UTF-8").newEncoder());{code}
> this part is exploitable as without any validation and canonical checks it is
> opened for writing which should be avoided for a public method
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
