bbende commented on PR #9138: URL: https://github.com/apache/nifi/pull/9138#issuecomment-2265132392
Thanks @exceptionfactory ! I noticed the CodeQL issues as well... I did sanitize the Filename header value before passing it to any code that would use it to write a File. If that isn't enough then I suppose a fall back option would be to write the file names with the generated UUID and store some kind of mapping file along side the asset that contains the original filename. The problem with this is that the value of the parameter that references the asset is going to be the concatenated paths of the assets and it's going to contain file names that the user has no idea what they are. Example, upload PostgresDriver.jar and it generates id 123, then reference this asset in a parameter named db_driver, and the value of the parameter will be '/path/to/assets/123'. So some looking at the parameter has no idea what file that is. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
