paulk-asert opened a new pull request, #2890:
URL: https://github.com/apache/groovy/pull/2890
…ation directory
A class page was written to destdir + "/" + fullPathName + ".html", and a
package page under destdir + "/" + packageDoc.name(), with the only guard being
that the name is not absolute. The name is a package path, and it picks up a
".." segment when a source file is named through a source path with one — so a
page could be written above the destination directory:
fullPathName = ../srcroot/sub/Pwned
-> <destdir>/../srcroot/sub/Pwned.html written outside destdir
The absolute-only check is replaced by one that normalises the resolved path
and confirms it stays within the destination directory, at both the class-page
and package-page sites. A name that would escape is skipped with a warning
rather than followed. The check is on the normalised paths, so it does not rely
on names having been sanitised earlier, and a legitimate package like a/b/c
still resolves within destdir and is unaffected.
The regression test builds a doc whose path carries "..", renders through a
mock output tool, and asserts that nothing it wrote resolves outside the
destination. It was confirmed to fail without the guard, writing to
<destdir>/../.../Pwned.html.
MockOutputTool gains a getOutputs() accessor so the test can inspect every
written path; it previously exposed only single-file lookup.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
