This is an automated email from the ASF dual-hosted git repository.

asf-gitbox-commits pushed a commit to annotated tag ANT_1.10.18_RC1
in repository https://gitbox.apache.org/repos/asf/ant.git

commit 07ee9c418e3bd3e7d0287fc9aaba3011e88f0dc2
Author: Stefan Bodewig <[email protected]>
AuthorDate: Sat Aug 22 15:44:24 2026 +0200

    add allowFilesToEscapeDest attribute to ftp task
---
 manual/Tasks/ftp.html                               |  7 +++++++
 .../apache/tools/ant/taskdefs/optional/net/FTP.java | 21 +++++++++++++++++++--
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/manual/Tasks/ftp.html b/manual/Tasks/ftp.html
index a6c80196e..be03e83e8 100644
--- a/manual/Tasks/ftp.html
+++ b/manual/Tasks/ftp.html
@@ -363,6 +363,13 @@ <h3>Parameters</h3>
       <em>Since Ant 1.10.15</em></td>
     <td>No</td>
   </tr>
+  <tr>
+    <td>allowFilesToEscapeDest</td>
+    <td>Whether to allow the received files or directories to be outside of 
the dest
+      directory.<br/>
+      <em>since Ant 1.10.18</em></td>
+    <td>No, defaults to <q>false</q>.</td>
+  </tr>
 </table>
 <h3>Note about <var>remotedir</var> attribute</h3>
 <table>
diff --git a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java 
b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java
index c9b338369..adae39978 100644
--- a/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java
+++ b/src/main/org/apache/tools/ant/taskdefs/optional/net/FTP.java
@@ -153,7 +153,7 @@ public class FTP extends Task implements FTPTaskConfig {
     private int dataTimeout = -1;
     private int wakeUpTransferInterval = -1;
     private long lastWakeUpTime = 0;
-
+    private boolean allowFilesToEscapeDest = false;
 
     protected static final String[] ACTION_STRS = {//NOSONAR
         "sending",
@@ -1642,6 +1642,16 @@ public class FTP extends Task implements FTPTaskConfig {
         }
     }
 
+    /**
+     * Whether to allow the retrieved files or directories to be outside of 
the dest directory.
+     *
+     * @param b the flag
+     * @since Ant 1.10.18
+     */
+    public void setAllowFilesToEscapeDest(boolean b) {
+        allowFilesToEscapeDest = b;
+    }
+
     /**
      * @return Returns the systemTypeKey.
      */
@@ -2344,7 +2354,14 @@ public class FTP extends Task implements FTPTaskConfig {
      */
     protected void getFile(FTPClient ftp, String dir, String filename)
         throws IOException, BuildException {
-        File file = getProject().resolveFile(new File(dir, 
filename).getPath());
+        File baseDir = getProject().resolveFile(dir);
+        File file = FILE_UTILS.resolveFile(baseDir, filename);
+        if (!allowFilesToEscapeDest && !FILE_UTILS.isLeadingPath(baseDir, 
file, true)) {
+            log("skipping " + filename + " as its target " + 
FILE_UTILS.getResolvedPath(file)
+                + " is outside of " + FILE_UTILS.getResolvedPath(baseDir) + 
".", Project.MSG_WARN);
+            skipped++;
+            return;
+        }
         OutputStream outstream = null;
         try {
             if (newerOnly && isUpToDate(ftp, file, resolveFile(filename))) {

Reply via email to