[
https://issues.apache.org/jira/browse/JCRVLT-860?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Konrad Windszus closed JCRVLT-860.
----------------------------------
> Reject package ids containing "/" or control characters
> -------------------------------------------------------
>
> Key: JCRVLT-860
> URL: https://issues.apache.org/jira/browse/JCRVLT-860
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Rishabh Daim
> Priority: Major
> Fix For: 3.2.10, 4.3.0
>
>
> {{assertValidJcrName}} is a character-class validator copied from
> jackrabbit's NameParser; its
> forbidden set was chosen for JCR name legality, not for the FS registry's use
> of the id as a
> relative filesystem path. \ falls into the generic accept branch, so
> name='..\..\evil' (or the same shape in a group segment or version) passes
> isValid(). On
> Windows, Path.resolve treats \ as a separator, so every path derived from the
> id —
> <name>.zip (Files.createDirectories/Files.move/Files.delete), the metadata
> .xml
> write, and the later remove() delete — escapes the registry home,
> pre-authorization and on
> the validated upload(InputStream) path. registerSubPackages makes the id
> attacker-supplied even when the operator never chose it (nested package's own
> properties.xml).
> https://github.com/apache/jackrabbit-filevault-private/issues/15
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
