nvharikrishna opened a new pull request, #367: URL: https://github.com/apache/cassandra-sidecar/pull/367
Making this change as part of [CEP-40](https://issues.apache.org/jira/browse/CASSSIDECAR-138). [CASSSIDECAR-479](https://issues.apache.org/jira/browse/CASSSIDECAR-479) Tightens the path check on the Live Migration file route so that symlinks inside a data directory cannot point to files outside the configured directory. Earlier, the route only checked the URL text for .. patterns. That check does not catch symlinks, so a symlink within the data dir could still resolve to a file elsewhere on disk. The route now also resolves the path with toRealPath() and confirms the resolved path stays inside the configured base directory. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
