lenamonj opened a new pull request, #769:
URL: https://github.com/apache/commons-text/pull/769
`PathFence.normalize` uses `toAbsolutePath().normalize()`, which removes
`..` segments but does not follow symbolic links. A link inside a fence that
points outside it passes the fence:
```java
Files.createSymbolicLink(inside.resolve("link.txt"),
outside.resolve("secret.txt"));
StringLookupFactory.builder().setFences(inside).get().fileStringLookup().lookup("UTF-8:"
+ inside.resolve("link.txt"));
// returns the contents of outside/secret.txt
```
Same class of bypass as #745, via links instead of `..`.
Resolve the deepest existing ancestor with `toRealPath()` and re-attach the
remaining segments; a path that does not exist yet has no link to follow. Fence
roots go through the same method, so a root that is itself a link still fences
its target. New `PathFenceTest` covers both link cases and aborts where the
platform cannot create links.
Default `mvn` goal passes on JDK 21, 1895 tests.
Found by an automated audit loop (Claude); patch and description reviewed by
me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
