paulk-asert opened a new pull request, #2893:
URL: https://github.com/apache/groovy/pull/2893
…le cache
uninstallArtifact deletes the jars named by a module's cached ivy
descriptor. The jar path was new File(jardir, name) with name taken from the
descriptor's artifact attributes unchecked, so a name carrying a path separator
or a ".." segment deleted a file outside the module's jars directory:
<artifact name="../victim" .../>
-> new File(jardir, "../victim-1.0.jar").delete() above jardir
The deletion is now skipped, with a warning, unless the resolved file is
inside the jars directory. The check is on canonical paths, so a ".." or a
symbolic link along the way cannot carry it out, and it covers the version,
classifier and extension that are concatenated into the name as well.
Strictly this is out of the security model: a crafted descriptor is cached
only by resolving from a repository, and resolving from an untrusted repository
already runs its code, so a delete-on-uninstall is weaker than what such a
repository already achieved. It is fixed anyway, as defense in depth and
because a tool should not delete outside its own cache whatever a descriptor
says, matching the containment added for deleteDir and groovydoc.
The regression test builds a module cache with a traversing artifact name,
runs uninstall, and asserts the outside file survives while an ordinary
artifact is still deleted; it was confirmed to delete the outside file without
the guard. It runs under -Djunit.network=true with the other groovy.grape
tests, though it needs no network itself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
