n.v.harikrishna created CASSSIDECAR-479:
-------------------------------------------
Summary: Tighten path containment in Live Migration file route
Key: CASSSIDECAR-479
URL: https://issues.apache.org/jira/browse/CASSSIDECAR-479
Project: Sidecar for Apache Cassandra
Issue Type: Sub-task
Reporter: n.v.harikrishna
Assignee: n.v.harikrishna
The Live Migration file resolver currently relies on a lexical .. check to keep
requests inside the configured directories. Cassandra data directories don't
normally contain symlinks, but the lexical check alone can't see through them,
so this is a small defense-in-depth gap. This change adds a real-path
containment check (toRealPath() against the canonical base directory) on the
source side. Symlinks that resolve to targets within the configured directory
continue to work.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
