This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to annotated tag ANT_1.10.18_RC1 in repository https://gitbox.apache.org/repos/asf/ant.git
commit 07ee9c418e3bd3e7d0287fc9aaba3011e88f0dc2 Author: Stefan Bodewig <[email protected]> AuthorDate: Sat Aug 22 15:44:24 2026 +0200 add allowFilesToEscapeDest attribute to ftp task --- manual/Tasks/ftp.html | 7 +++++++ .../apache/tools/ant/taskdefs/optional/net/FTP.java | 21 +++++++++++++++++++-- 2 files changed, 26 insertions(+), 2 deletions(-) diff --git a/manual/Tasks/ftp.html b/manual/Tasks/ftp.html index a6c80196e..be03e83e8 100644 --- a/manual/Tasks/ftp.html +++ b/manual/Tasks/ftp.html @@ -363,6 +363,13 @@ <h3>Parameters</h3> <em>Since Ant 1.10.15</em></td> <td>No</td> </tr> + <tr> + <td>allowFilesToEscapeDest</td> + <td>Whether to allow the received files or directories to be outside of the dest + directory.<br/> + <em>since Ant 1.10.18</em></td> + <td>No, defaults to <q>false</q>.</td> + </tr> </table> <h3>Note about <var>remotedir</var> attribute</h3> <table> diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java index c9b338369..adae39978 100644 --- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java +++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java @@ -153,7 +153,7 @@ public class FTP extends Task implements FTPTaskConfig { private int dataTimeout = -1; private int wakeUpTransferInterval = -1; private long lastWakeUpTime = 0; - + private boolean allowFilesToEscapeDest = false; protected static final String[] ACTION_STRS = {//NOSONAR "sending", @@ -1642,6 +1642,16 @@ public class FTP extends Task implements FTPTaskConfig { } } + /** + * Whether to allow the retrieved files or directories to be outside of the dest directory. + * + * @param b the flag + * @since Ant 1.10.18 + */ + public void setAllowFilesToEscapeDest(boolean b) { + allowFilesToEscapeDest = b; + } + /** * @return Returns the systemTypeKey. */ @@ -2344,7 +2354,14 @@ public class FTP extends Task implements FTPTaskConfig { */ protected void getFile(FTPClient ftp, String dir, String filename) throws IOException, BuildException { - File file = getProject().resolveFile(new File(dir, filename).getPath()); + File baseDir = getProject().resolveFile(dir); + File file = FILE_UTILS.resolveFile(baseDir, filename); + if (!allowFilesToEscapeDest && !FILE_UTILS.isLeadingPath(baseDir, file, true)) { + log("skipping " + filename + " as its target " + FILE_UTILS.getResolvedPath(file) + + " is outside of " + FILE_UTILS.getResolvedPath(baseDir) + ".", Project.MSG_WARN); + skipped++; + return; + } OutputStream outstream = null; try { if (newerOnly && isUpToDate(ftp, file, resolveFile(filename))) {
