https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=42404
--- Comment #48 from Tomás Cohen Arazi (tcohen) <[email protected]> --- Created attachment 209367 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=209367&action=edit Bug 42404: (follow-up) Tighten path checks in BatchImportCoverImages The checks on the image paths read from the mapping file were weaker than they looked: - The symlink check ran on the path returned by Cwd::abs_path, which has already resolved symlinks, so it could never match. - The containment check was a plain prefix match on the extraction directory, so a sibling directory sharing the prefix (e.g. /tmp/abc and /tmp/abcx) was accepted. This patch checks for symlinks before resolving the path, and requires the resolved path to start with the extraction directory followed by a '/'. It also validates the id (and finds the item, when targeting items) before opening the image, so bad lines do not load images for nothing, and trims whitespace around the id like it was already done for the filename. Note: Archive::Zip extracts symlink entries as regular files, so the symlink check is defense in depth. The tests add the symlink after extraction. Test plan: 1. Apply patch 2. Run: $ ktd --shell k$ prove t/db_dependent/Koha/BackgroundJob/BatchImportCoverImages.t => SUCCESS: Tests pass! 3. Revert the changes to Koha/BackgroundJob/BatchImportCoverImages.pm and repeat 2 => FAIL: The sibling directory and the symlink are accepted 4. Sign off :-D Assisted-by: Opus 5.5 (Anthropic) -- You are receiving this mail because: You are watching all bug changes. _______________________________________________ Koha-bugs mailing list -- [email protected] To unsubscribe send an email to [email protected] website : http://www.koha-community.org/ git : http://git.koha-community.org/ bugs : http://bugs.koha-community.org/
