This is an automated email from the ASF dual-hosted git repository. hequn pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push: new c27a7a6 [FLINK-18151][python] Resolve CWE22 problems in pyflink_gateway_server.py (#12503) c27a7a6 is described below commit c27a7a6f73ac7a082b0c9418f154ccfdcf7a0a31 Author: Shuiqiang Chen <acqua....@alibaba-inc.com> AuthorDate: Mon Jun 8 10:18:39 2020 +0800 [FLINK-18151][python] Resolve CWE22 problems in pyflink_gateway_server.py (#12503) --- flink-python/pyflink/pyflink_gateway_server.py | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/flink-python/pyflink/pyflink_gateway_server.py b/flink-python/pyflink/pyflink_gateway_server.py index 9f0adfc..829886c 100644 --- a/flink-python/pyflink/pyflink_gateway_server.py +++ b/flink-python/pyflink/pyflink_gateway_server.py @@ -41,8 +41,12 @@ def find_java_executable(): flink_conf_path = os.path.join(flink_home, "conf", "flink-conf.yaml") java_home = None - if os.path.isfile(flink_conf_path): - with open(flink_conf_path, "r") as f: + # get the realpath of tainted path value to avoid CWE22 problem that constructs a path or URI + # using the tainted value and might allow an attacker to access, modify, or test the existence + # of critical or sensitive files. + real_flink_conf_path = os.path.realpath(flink_conf_path) + if os.path.isfile(real_flink_conf_path): + with open(real_flink_conf_path, "r") as f: flink_conf_yaml = f.read() java_homes = re.findall(r'^[ ]*env\.java\.home[ ]*: ([^#]*).*$', flink_conf_yaml) if len(java_homes) > 1: @@ -85,14 +89,18 @@ def construct_log_settings(): def construct_classpath(): flink_home = _find_flink_home() + # get the realpath of tainted path value to avoid CWE22 problem that constructs a path or URI + # using the tainted value and might allow an attacker to access, modify, or test the existence + # of critical or sensitive files. + real_flink_home = os.path.realpath(flink_home) if on_windows(): # The command length is limited on Windows. To avoid the problem we should shorten the # command length as much as possible. - lib_jars = os.path.join(flink_home, "lib", "*") + lib_jars = os.path.join(real_flink_home, "lib", "*") else: - lib_jars = os.pathsep.join(glob.glob(os.path.join(flink_home, "lib", "*.jar"))) + lib_jars = os.pathsep.join(glob.glob(os.path.join(real_flink_home, "lib", "*.jar"))) - flink_python_jars = glob.glob(os.path.join(flink_home, "opt", "flink-python*.jar")) + flink_python_jars = glob.glob(os.path.join(real_flink_home, "opt", "flink-python*.jar")) if len(flink_python_jars) < 1: print("The flink-python jar is not found in the opt folder of the FLINK_HOME: %s" % flink_home)