exceptionfactory commented on PR #9138: URL: https://github.com/apache/nifi/pull/9138#issuecomment-2265304821
Thanks for the reply @bbende. Several classes mitigate the path traversal problem using Java Path objects with normalization and checking that the resolved child path starts with the selected parent path. https://github.com/apache/nifi/blob/83d2078a4f878ba742f8adba2da382fb117ad6c0/nifi-system-tests/nifi-system-test-extensions-bundle/nifi-system-test-extensions/src/main/java/org/apache/nifi/flow/registry/FileSystemFlowRegistryClient.java#L434 It appears that the parent Parameter Context ID also needs to be checked. Instead of using the user-provided value, recommend looking up the Parameter Context and using the ID returned. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
