soma0212 opened a new pull request, #16838: URL: https://github.com/apache/lucene/pull/16838
REVIEWER NOTE (for Soma, not part of the PR body): Lucene's AI_POLICY.md requires the PR description and all replies to maintainers to be written in your own words, and prohibits autonomous-agent contributions. Review the patch, make sure you understand and can explain it, then write the PR body yourself; the draft below is reference material, not text to paste. Also replace GITHUB#XXXXX in the lucene/CHANGES.txt entry with the real PR number before pushing (git commit --amend). The repo PR template has a single '### Description' section. Prior maintainer feedback on this repo: do not frame hardening fixes as security issues in CHANGES entries. Draft description (rewrite in your own words): File names in the copy-state file map come from the primary node over the wire, but the replica passes them straight to Directory methods that resolve them against its index directory: - Node.readLocalFileMetaData opens the name via dir.openInput - CopyOneFile creates the temp output with the name as prefix - the copy job's finish/cancel paths rename and delete by those names A name like ../escaped.bin therefore reads, writes or deletes files outside the replica's index directory (FSDirectory just does directory.resolve(name), and the Directory contract has no sub-folder hierarchy). Added validation in getFilesToCopy, which every CopyJob constructor runs on its complete file map before any I/O, rejecting anything that is not a plain file name. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
