Paul King created GROOVY-12360:
----------------------------------
Summary: GroovyDocWriter: keep generated pages inside the
destination directory
Key: GROOVY-12360
URL: https://issues.apache.org/jira/browse/GROOVY-12360
Project: Groovy
Issue Type: Improvement
Reporter: Paul King
Assignee: Paul King
A class page was written to destdir + "/" + fullPathName + ".html", and a
package page under destdir + "/" + packageDoc.name(), with the only guard
being that the name is not absolute. The name is a package path, and it
picks up a ".." segment when a source file is named through a source path
with one — so a page could be written above the destination directory:
fullPathName = ../srcroot/sub/Pwned
-> <destdir>/../srcroot/sub/Pwned.html written outside destdir
The absolute-only check is replaced by one that normalises the resolved
path and confirms it stays within the destination directory, at both the
class-page and package-page sites. A name that would escape is skipped
with a warning rather than followed. The check is on the normalised paths,
so it does not rely on names having been sanitised earlier, and a
legitimate package like a/b/c still resolves within destdir and is
unaffected.
The regression test builds a doc whose path carries "..", renders through
a mock output tool, and asserts that nothing it wrote resolves outside the
destination. It was confirmed to fail without the guard, writing to
<destdir>/../.../Pwned.html.
MockOutputTool gains a getOutputs() accessor so the test can inspect every
written path; it previously exposed only single-file lookup.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
