[
https://issues.apache.org/jira/browse/CASSSIDECAR-479?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Francisco Guerrero updated CASSSIDECAR-479:
-------------------------------------------
Source Control Link:
https://github.com/apache/cassandra-sidecar/commit/74d400cefce464702dbc2c59ae9f22a5bf2d3541
Resolution: Fixed
Status: Resolved (was: Ready to Commit)
> Tighten path containment in Live Migration file route
> -----------------------------------------------------
>
> Key: CASSSIDECAR-479
> URL: https://issues.apache.org/jira/browse/CASSSIDECAR-479
> Project: Sidecar for Apache Cassandra
> Issue Type: Sub-task
> Components: Security
> Reporter: n.v.harikrishna
> Assignee: n.v.harikrishna
> Priority: Normal
> Fix For: 0.5
>
>
> The Live Migration file resolver currently relies on a lexical .. check to
> keep requests inside the configured directories. Cassandra data directories
> don't normally contain symlinks, but the lexical check alone can't see
> through them, so this is a small defense-in-depth gap. This change adds a
> real-path containment check (toRealPath() against the canonical base
> directory) on the source side. Symlinks that resolve to targets within the
> configured directory continue to work.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
