This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to annotated tag ANT_1.10.18_RC1 in repository https://gitbox.apache.org/repos/asf/ant.git
commit 7809cdd503b94b1760eee4145af13655078dc302 Author: Stefan Bodewig <[email protected]> AuthorDate: Mon Aug 24 19:26:45 2026 +0200 add allowFilesToEscapeDest attribute to FTPTask class --- .../tools/ant/taskdefs/optional/net/FTPTask.java | 18 ++++++++++++++++++ .../ant/taskdefs/optional/net/FTPTaskMirrorImpl.java | 12 ++++++++++-- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java index 6d2e73923..72cdd011b 100644 --- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java +++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTask.java @@ -103,6 +103,7 @@ public class FTPTask extends Task implements FTPTaskConfig { private String siteCommand = null; private String initialSiteCommand = null; private boolean enableRemoteVerification = true; + private boolean allowFilesToEscapeDest = false; private Path classpath; private ClassLoader mirrorLoader; @@ -728,6 +729,23 @@ public class FTPTask extends Task implements FTPTaskConfig { return enableRemoteVerification; } + /** + * Whether to allow the retrieved files or directories to be outside of the dest directory. + * + * @param b the flag + * @since Ant 1.10.18 + */ + public void setAllowFilesToEscapeDest(boolean b) { + allowFilesToEscapeDest = b; + } + + /** + * @since Ant 1.10.18 + */ + public boolean getAllowFilesToEscapeDest() { + return allowFilesToEscapeDest; + } + /** * Checks to see that all required parameters are set. * diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java index 77816de24..139706e57 100644 --- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java +++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTPTaskMirrorImpl.java @@ -1632,10 +1632,18 @@ public class FTPTaskMirrorImpl implements FTPTaskMirror { */ protected void getFile(FTPClient ftp, String dir, String filename) throws IOException, BuildException { + File baseDir = task.getProject().resolveFile(dir); + File file = FILE_UTILS.resolveFile(baseDir, filename); + if (!task.getAllowFilesToEscapeDest() + && !FILE_UTILS.isLeadingPath(baseDir, file, true)) { + task.log("skipping " + filename + " as its target " + FILE_UTILS.getResolvedPath(file) + + " is outside of " + FILE_UTILS.getResolvedPath(baseDir) + ".", Project.MSG_WARN); + skipped++; + return; + } + OutputStream outstream = null; try { - File file = task.getProject().resolveFile(new File(dir, filename).getPath()); - if (task.isNewer() && isUpToDate(ftp, file, resolveFile(filename))) { return; }
