Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick f46db6aac3e9 from chromium #36589

Merged
merged 5 commits into from
Dec 12, 2022

Conversation

ppontes
Copy link
Member

@ppontes ppontes commented Dec 6, 2022

Do not traverse directory symlinks when uploading folder

Previous patch crrev.com/c/3866767 removed symlink files when uploading
a folder. However, while the remaining files are themselves not
symlinks, they may be included as the result of traversing directory
symlink.

This patch further excludes such files by checking if any parent
directory is a symlink, all the way until the base directory (which is
the directory chosen for upload).

(cherry picked from commit 4fa830d8af6b2fb293219edeb39eebccfd322305)

Fixed: 1378997
Change-Id: I75a92df4cd50f9aba7824955a3de792583bc6154
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3997720
Reviewed-by: Austin Sullivan asully@chromium.org
Reviewed-by: Mason Freed masonf@chromium.org
Reviewed-by: Alex Moshchuk alexmos@chromium.org
Commit-Queue: Xiaocheng Hu xiaochengh@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#1067310}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4025427
Bot-Commit: Rubber Stamper rubber-stamper@appspot.gserviceaccount.com
Commit-Queue: Srinivas Sista srinivassista@chromium.org
Owners-Override: Srinivas Sista srinivassista@chromium.org
Cr-Commit-Position: refs/branch-heads/5359@{#823}
Cr-Branched-From: 27d3765d341b09369006d030f83f582a29eb57ae-refs/heads/main@{#1058933}

Notes: Security: backported fix for CVE-2022-4190.

@ppontes ppontes requested review from a team as code owners December 6, 2022 17:56
@ppontes ppontes added 21-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes labels Dec 6, 2022
@electron-cation electron-cation bot added new-pr 🌱 PR opened in the last 24 hours and removed new-pr 🌱 PR opened in the last 24 hours labels Dec 6, 2022
@MarshallOfSound MarshallOfSound merged commit ef73a91 into 21-x-y Dec 12, 2022
@MarshallOfSound MarshallOfSound deleted the cherry-pick/21-x-y/chromium/f46db6aac3e9 branch December 12, 2022 20:17
@release-clerk
Copy link

release-clerk bot commented Dec 12, 2022

Release Notes Persisted

Security: backported fix for CVE-2022-4190.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
21-x-y backport-check-skip Skip trop's backport validity checking security 🔒 semver/patch backwards-compatible bug fixes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants