[
https://issues.apache.org/jira/browse/GROOVY-12370?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18111999#comment-18111999
]
ASF GitHub Bot commented on GROOVY-12370:
-----------------------------------------
paulk-asert opened a new pull request, #2894:
URL: https://github.com/apache/groovy/pull/2894
A package's doc-files/ and snippet-files/ directories are mirrored into the
output verbatim. The mirror walked the tree and copied each entry with
Files.copy, which follows a symbolic link and copies the content of its target.
A link pointing outside the source tree therefore placed that outside content
into the published documentation:
doc-files/leak.txt -> ../../../secret/passwd
published as doc-files/leak.txt containing the secret
A link, or other reparse point such as a Windows junction, is now skipped
with a warning rather than followed, so only the files actually inside the
resource directory are published. An ordinary file beside the link is copied as
before.
The regression test puts a symbolic link to a file outside the tree into a
package's doc-files/, renders, and asserts the link was not copied while a real
asset in the same directory was; it was confirmed to copy the link's target
content without the guard.
> GroovyDocWriter: do not copy a symbolic link out of a resource directory
> ------------------------------------------------------------------------
>
> Key: GROOVY-12370
> URL: https://issues.apache.org/jira/browse/GROOVY-12370
> Project: Groovy
> Issue Type: Improvement
> Reporter: Paul King
> Priority: Major
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
