Merge pull request #4 from BulkSecurityGeneratorProjectV2/fix/JLL/par…

…tial-path-traversal-vulnerability [SECURITY] Fix Partial Path Traversal Vulnerability
jlangch · Jul 29, 2022 · 215ae91 · 215ae91
2 parents 4b2fb36 + c942c73
commit 215ae91
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/com/github/jlangch/venice/impl/util/io/LoadPaths.java b/src/main/java/com/github/jlangch/venice/impl/util/io/LoadPaths.java
@@ -258,7 +258,7 @@ private boolean isFileWithinDirectory(
         if (dir_.isDirectory()) {
             final File fl = new File(dir_, file.getPath());
             if (fl.isFile()) {
-                if (fl.getCanonicalPath().startsWith(dir_.getCanonicalPath())) {
+                if (fl.getCanonicalFile().toPath().startsWith(dir_.getCanonicalFile().toPath())) {
                     // Prevent accessing files outside the load-path.
                     // E.g.: ../../coffee
                     return true;