dxbjavid opened a new pull request, #785:
URL: https://github.com/apache/commons-text/pull/785
StringLookupFactory.Builder.setFences says the fences apply to the file,
properties and XML lookups, and on a fenced factory fileStringLookup(),
propertiesStringLookup() and xmlStringLookup() do honour them. The interpolator
from that same factory does not, though. interpolatorStringLookup() returns the
shared unfenced InterpolatorStringLookup.INSTANCE, and the other
interpolatorStringLookup overloads build an InterpolatorStringLookup that takes
its defaults from StringLookupFactory.INSTANCE. So new
StringSubstitutor(factory.interpolatorStringLookup()), which is the setup
CustomStringSubstitutorTest describes as a fenced StringSubstitutor, still
resolves ${file:UTF-8:/any/path}, ${properties:...} and ${xml:...} anywhere on
disk. That is a path traversal past the fence for anyone interpolating text
they do not fully control.
Repro: with the fence set to a directory fence/,
factory.fileStringLookup().apply("UTF-8:outside.txt") throws
IllegalArgumentException, but new
StringSubstitutor(factory.interpolatorStringLookup()).replace("${file:UTF-8:outside.txt}")
returns the file contents. The existing fence assertions in
FileStringLookupTest/PropertiesStringLookupTest only use files that do not
exist (/foo.txt, ../foo.txt), so they pass whether or not the fence is applied,
which is probably why this went unnoticed.
Fix: when the factory has fences, addDefaultStringLookups replaces the
default file, properties and xml entries with their fenced counterparts (only
if the entry is still the default one, so a lookup left out through the
defaultStringLookups system property stays out), and every
interpolatorStringLookup overload now builds its InterpolatorStringLookup from
this factory. StringLookupFactory.INSTANCE has no fences, so unfenced behaviour
and StringSubstitutor.createInterpolator() are unchanged. The new
StringLookupFactoryTest#testFencedInterpolatorStringLookup reads documents
outside the fence through all four overloads; it fails without the main change
and passes with it. The default mvn build is green (1990 tests).
---
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [x] Read the [ASF Generative Tooling
Guidance](https://www.apache.org/legal/generative-tooling.html) if you use
Artificial Intelligence (AI).
- [x] I used AI to create any part of, or all of, this pull request. Which
AI tool was used to create this pull request, and to what extent did it
contribute? Claude Code found the issue and drafted the patch, test and
description; I reviewed them before submitting.
- [x] Run a successful build using the default
[Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command
line by itself.
- [x] Write unit tests that match behavioral changes, where the tests fail
if the changes to the runtime are not applied. This may not always be possible,
but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand
what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line
and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
