The GitHub Actions job "Java CI with Maven" on 
stormcrawler.git/issue-2081-file-protocol-root has failed.
Run started by GitHub user abhinav-phi (triggered by rzo1).

Head commit for run:
a902982fd22dd55e1da2b24190b1d8f21e80fafb / abhinav-phi <[email protected]>
Refuse file URLs with a host, note the check-vs-read window (#2081)

Review feedback on #2124:

- a file URL carrying a host component (file://evil.example.com/etc/passwd)
  is refused outright instead of the host being silently ignored: the
  host is meaningless for a local read, and accepting it would only
  invite spellings that look remote
- a comment documents the accepted check-vs-read window: canonicalise
  and check are two operations, so a symlink swapped in between would
  be followed; that is fine now that the file scheme is opt-in and
  root-confined, the operator who enables it accepts the worker user's
  read rights as the boundary
- confirmed nothing in the archetypes or the ProtocolFactory assumes
  file is in the protocols list

Report URL: https://github.com/apache/stormcrawler/actions/runs/34153965167

With regards,
GitHub Actions via GitBox

Reply via email to