[
https://issues.apache.org/jira/browse/KNOX-2644?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17426631#comment-17426631
]
Larry McCay commented on KNOX-2644:
-----------------------------------
Due to upcoming release of 1.6.0 and the need for an incompatible change coming
up for log4j migration, we are moving this out to the 2.0.0 release. As of now,
1.6.0 will be the last 1.x.x release due to the incompatible change. If there
is a critical need for this in 1.6.0 please feel free to move the fixVersion
back to 1.6.0 with a note of justification.
> Topology names should be validated when uploaded via API
> --------------------------------------------------------
>
> Key: KNOX-2644
> URL: https://issues.apache.org/jira/browse/KNOX-2644
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 1.5.0
> Reporter: Philip Zampino
> Priority: Major
> Fix For: 2.0.0
>
>
> DefaultTopologyService#deployTopology does not validate the topology's name
> to prevent the creation of files outside the location or intent of the API.
> The name could be something like _*../gateway-site*_, which could be used to
> overwrite the gateway configuration.
> (e.g., _KNOX_HOME_/conf/topologies/../gateway-site.xml)
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
