[
https://issues.apache.org/jira/browse/JCRVLT-861?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Konrad Windszus closed JCRVLT-861.
----------------------------------
> Reject platform names containing traversal characters (.., or /)
> ----------------------------------------------------------------
>
> Key: JCRVLT-861
> URL: https://issues.apache.org/jira/browse/JCRVLT-861
> Project: Jackrabbit FileVault
> Issue Type: Bug
> Reporter: Konrad Windszus
> Assignee: Julian Reschke
> Priority: Major
> Fix For: 4.3.0
>
>
> The platform→repository name decoder is trusted to return a single path
> segment, but nothing
> enforces it: %2f reintroduces / (multi-segment injection into
> session.getNode/addNode
> relPaths), %2e%2e or a literal .. reintroduces dot-segments (normalized away
> by the
> repository after every string-level check has already passed). The encoder
> (getPlatformName) escapes / and %, so no legitimately exported package ever
> contains a
> platform name that decodes to one of these — the asymmetry is the attack
> surface. Every
> consumer (workspace-filter containment, getImportMode, /etc/packages
> subpackage-prefix
> detection, DocViewParser.getDocumentViewXmlRootNodePath on the validation
> side) reasons over
> the unresolved string while the repository writes to the resolved path.
> https://github.com/apache/jackrabbit-filevault-private/issues/8
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
