[GitHub] [nifi] joewitt commented on pull request #4639: Update PutFile.java: fix path traversal vulnerability

2020-11-03 Thread GitBox


joewitt commented on pull request #4639:
URL: https://github.com/apache/nifi/pull/4639#issuecomment-721276193


   Yep I am fine with that - perhaps 'prevent' is better than 'avoid'  The 
display name would be 'Prevent Path Escape' and the name would be 
'preventpathescape' or something consistent with how others do it.  Default of 
false is good.  Description will let the user know the purpose of the property 
if true is to detect whether the resolved path (including following symlinks) 
still appears inline with the intended specified target directory.   Where this 
could be confusing is when the base dir itself is a symlink and resolves to 
something else.  But the more context you can give the user on the intent and 
so long as this is purely optional it is fine.



This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org




[GitHub] [nifi] joewitt commented on pull request #4639: Update PutFile.java: fix path traversal vulnerability

2020-11-03 Thread GitBox


joewitt commented on pull request #4639:
URL: https://github.com/apache/nifi/pull/4639#issuecomment-720618061







This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org