Alan Mehio created CXF-8448:
-------------------------------
Summary: CodeQL : Uncontrolled data used in path expression.
Security check
Key: CXF-8448
URL: https://issues.apache.org/jira/browse/CXF-8448
Project: CXF
Issue Type: Bug
Components: Core
Affects Versions: 3.3.10
Reporter: Alan Mehio
CodeQL : Uncontrolled data used in path expression. Security check
The CodeQL for the build is failing due to [security issue check
|https://codeql.github.com/codeql-query-help/java/java-path-injection/] . The
build was triggered by push which did a refactor for the file
[AttachmentUtil|https://github.com/apache/cxf/pull/768/files#annotation_1255142036]
As we can see the line which is causing the CodeQL fail is 187 which is as below
bos.setOutputDir(new File((String)directory));
but the "directory" by an given by the caller which the class has not control
over.
if we see a sample of test cases usage of the
AttachmentDeserializer.ATTACHMENT_DIRECTORY
we can see System.getProperty("java.io.tmpdir") which is on linux
/tmp and by applying the rule, it will end up with tmp
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
