atokle commented on code in PR #1959:
URL: https://github.com/apache/maven-resolver/pull/1959#discussion_r3585554436
##########
maven-resolver-util/src/main/java/org/eclipse/aether/util/PathUtils.java:
##########
@@ -72,4 +75,50 @@ public static String stringToPathSegment(String string) {
}
return result.toString();
}
+
+ /**
+ * Validates that a coordinate component does not contain path traversal
sequences
+ * or path separator characters that could cause the composed path to
escape
+ * the local repository directory.
+ *
+ * @since 2.0.21
+ */
+ public static void validatePathComponent(String value, String label) {
+ if (value != null && !value.isEmpty()) {
+ // Important: "equals .." and not "contains ..", as if escape
attempted, it will contain path separators
+ // OTOH: version "1.." is valid version string!
+ if (value.equals("..") || value.contains("/") ||
value.contains("\\")) {
+ throw new IllegalArgumentException(
+ "Invalid " + label + ": must not contain '..', '/' or
'\\': " + value);
Review Comment:
Should maybe be:
"Invalid " + label + ": must not be equal to '..' or contain '/' or '\\': "
+ value);
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
