janhoy commented on a change in pull request #1572:
URL: https://github.com/apache/lucene-solr/pull/1572#discussion_r439772139
##########
File path: solr/core/src/java/org/apache/solr/core/CoreContainer.java
##########
@@ -1259,6 +1277,20 @@ public SolrCore create(String coreName, Path
instancePath, Map<String, String> p
}
}
+ /**
+ * Checks that the given path is relative to SOLR_HOME, SOLR_DATA_HOME,
coreRootDirectory or one of the paths
+ * specified in solr.xml's allowPaths element.
+ * @param path path to check
+ * @throws SolrException if path is outside allowed paths
+ */
+ public void assertPathAllowed(Path path) throws SolrException {
+ if (path.normalize().equals(path) && !path.isAbsolute()) return;
Review comment:
I pushed a commit addressing this. Quite a few changes, but we now
detect `..` specifically.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
