natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Path Traversal fix in SSTableRepairedAtSetter.java 

A Path Traversal issue reported by Snyk security scanner has been fixed by Mobb Automatic Fixer.
This commit is contained in:
tomer-mobb 2024-01-15 23:15:13 +07:00 committed by GitHub
parent ab142f8d28
commit 88dbf121e3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 31 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
src/java/org/apache/cassandra/tools/SSTableRepairedAtSetter.java
View File

@ -29,6 +29,8 @@ import java.util.List;
import org.apache.cassandra.io.sstable.Descriptor;
import org.apache.cassandra.io.sstable.format.SSTableFormat.Components;
import org.apache.cassandra.io.util.File;
import java.io.File;
import java.net.URI;
public class SSTableRepairedAtSetter
{
@ -69,6 +71,8 @@ public class SSTableRepairedAtSetter
for (String fname: fileNames)
{
// Path Traversal issue fixed by Mobb:
ensurePathIsRelative(fname);
Descriptor descriptor = Descriptor.fromFileWithComponent(new File(fname), false).left;
if (!descriptor.version.isCompatible())
{
@ -87,4 +91,31 @@ public class SSTableRepairedAtSetter
}
}
}
private static void ensurePathIsRelative(String path) {
ensurePathIsRelative(new File(path));
}
private static void ensurePathIsRelative(URI uri) {
ensurePathIsRelative(new File(uri));
}
private static void ensurePathIsRelative(File file) {
// Based on https://stackoverflow.com/questions/2375903/whats-the-best-way-to-defend-against-a-path-traversal-attack/34658355#34658355
String canonicalPath;
String absolutePath;
if (file.isAbsolute()) {
throw new RuntimeException("Potential directory traversal attempt - absolute path not allowed");
}
try {
canonicalPath = file.getCanonicalPath();
absolutePath = file.getAbsolutePath();
} catch (IOException e) {
throw new RuntimeException("Potential directory traversal attempt", e);
}
if (!canonicalPath.startsWith(absolutePath) || !canonicalPath.equals(absolutePath)) {
throw new RuntimeException("Potential directory traversal attempt");
}
}
}