nick-boss-tech commented on PR #5287: URL: https://github.com/apache/solr/pull/5287#issuecomment-6745536672
🤖 *AI-assisted text, posted on behalf of Nick Shanin* 🤖 There is also a path-boundary issue in the new local repository import. The allowed-path check is applied to the requested location, but traversal follows symbolic links inside that directory. A ConfigSet editor can therefore cause the import to read outside the intended allowed paths when the local repository contains such a link. The single-file import has the same concern. This depends on the local repository contents and the caller's ConfigSet permissions. The earlier [offered patch](https://github.com/apache/solr/pull/5287#issuecomment-6653195270) includes path checks and symlink regression tests. The PR has since gained a documentation commit, so the old fast-forward command in that comment is no longer valid at the current PR head. I'm preparing an updated branch on the current head for Linux verification; no new test result is available yet. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
