Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Test server should reject file paths from outside the repository #320

Closed
Schahen opened this issue Jun 30, 2020 · 1 comment
Closed

Test server should reject file paths from outside the repository #320

Schahen opened this issue Jun 30, 2020 · 1 comment
Labels
security Security-related cocerns testing
Milestone
0.5.5

Comments

@Schahen
Copy link
Contributor

Schahen commented Jun 30, 2020

For test small nodejs server is launched, the only purpose of which is to receive filepath, convert it to binary and pass to the jvm side. In theory attacker can scan for the port on which this server is launched and pass an arbitrary filename - not necessarily from repo. If server will recognize file format it will give up the data for the attacker.

The obvious simplest countermeasure is to allow files only from within the project.
@Schahen Schahen added security Security-related cocerns testing labels Jun 30, 2020
@Schahen Schahen added this to the 0.5.5 milestone Jun 30, 2020
Schahen added a commit that referenced this issue Jun 30, 2020
@Schahen
Skip all test resources that does not belong to the project dir
e482c14 
see #320
@Schahen
Copy link
Contributor Author

Schahen commented Jul 3, 2020

Will be part for 0.5.5

@Schahen Schahen closed this as completed Jul 3, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
security Security-related cocerns testing
Projects
None yet
Milestone
0.5.5
Development

No branches or pull requests
1 participant
@Schahen