Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Path Manipulation #2297

Closed
QiAnXinCodeSafe opened this issue Nov 23, 2021 · 1 comment
Closed

Path Manipulation #2297

QiAnXinCodeSafe opened this issue Nov 23, 2021 · 1 comment
Labels
enhancement New feature or request

Comments

@QiAnXinCodeSafe
Copy link

@PostMapping("/packages")
public CommonResponseDto uploadPluginPackage(@RequestParam(value = "zip-file") MultipartFile file)
throws Exception {
if (file == null || file.isEmpty())
throw new IllegalArgumentException("zip-file required.");
UploadPackageResultDto result = pluginArtifactsMgmtService.uploadPackage(file);
return okayWithData(result);
}

@Transactional
public UploadPackageResultDto uploadPackage(MultipartFile pluginPackageFile) {
// 1. save package file to local
String tmpFileName = new SimpleDateFormat("yyyyMMddHHmmssSSS").format(new Date());
File localFilePath = new File(SystemUtils.getTempFolderPath() + tmpFileName + "/");
log.info("tmp File Path= {}", localFilePath.getName());
try {
UploadPackageResultDto result = performUploadPackage(pluginPackageFile, localFilePath);
return result;
} finally {
if (localFilePath != null && localFilePath.exists()) {
log.info("try to clean up temporary files:{}", localFilePath.getAbsolutePath());
FileUtils.deleteQuietly(localFilePath);
}
}
}

protected UploadPackageResultDto performUploadPackage(MultipartFile pluginPackageFile, File localFilePath) {
String pluginPackageFileName = pluginPackageFile.getName();
if (!localFilePath.exists()) {
if (localFilePath.mkdirs()) {
log.info("Create directory [{}] successful", localFilePath.getAbsolutePath());
} else {
String errMsg = String.format("Create directory [%s] failed.", localFilePath.getAbsolutePath());
throw new WecubeCoreException("3099", errMsg, localFilePath.getAbsolutePath());
}
}
File dest = new File(localFilePath, "/" + pluginPackageFileName);
try {

We found 'file' may be contaminated on line 77 of PluginPackageController.java.Use of unfiltered data in selection of requested application file path could lead to sensitive data disclosure and potential theft of proprietary business logic.It will affect on line 487 of PluginArtifactsMgmtService.java

@QiAnXinCodeSafe QiAnXinCodeSafe added the enhancement New feature or request label Nov 23, 2021
gavin2lee added a commit that referenced this issue Dec 2, 2021
@gavin2lee
Copy link
Contributor

add upload filename validation to fix this issue

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants