4.4 export security fix (#3370)

* [vFQk1rX0] Fix security issue * [vFQk1rX0] Add more test cases from PR review
neo4j-contrib · Dec 16, 2022 · 01e63ed · 01e63ed
1 parent 7d3a491
commit 01e63ed
Show file tree

Hide file tree

Showing 4 changed files with 312 additions and 47 deletions.
diff --git a/core/src/main/java/apoc/export/csv/ExportCSV.java b/core/src/main/java/apoc/export/csv/ExportCSV.java
@@ -116,8 +116,8 @@ private Stream<ProgressInfo> exportCsv(@Name("file") String fileName, String sou
 
     private void dump(Object data, ExportConfig c, ProgressReporter reporter, ExportFileManager printWriter, CsvFormat exporter) {
         if (data instanceof SubGraph)
-            exporter.dump((SubGraph)data,printWriter,reporter,c);
+            exporter.dump((SubGraph) data, printWriter, reporter, c);
         if (data instanceof Result)
-            exporter.dump((Result)data,printWriter,reporter,c);
+            exporter.dump((Result) data, printWriter, reporter, c);
     }
 }
diff --git a/core/src/main/java/apoc/util/FileUtils.java b/core/src/main/java/apoc/util/FileUtils.java
@@ -227,7 +227,7 @@ private static Path getPath(String url) {
         Path urlPath;
         URL toURL = null;
         try {
-            final URI uri = URI.create(url.trim());
+            final URI uri = URI.create(url.trim()).normalize();
             toURL = uri.toURL();
             urlPath = Paths.get(uri);
         } catch (Exception e) {
@@ -242,10 +242,10 @@ private static Path getPath(String url) {
 
     private static boolean pathStartsWithOther(Path resolvedPath, Path basePath) throws IOException {
         try {
-            return resolvedPath.toRealPath().startsWith(basePath.toRealPath());
+            return resolvedPath.toFile().getCanonicalFile().toPath().startsWith(basePath.toRealPath());
         } catch (Exception e) {
-            if (e instanceof NoSuchFileException) { // If we're about to creating a file this exception has been thrown
-                return resolvedPath.normalize().startsWith(basePath);
+            if (e instanceof NoSuchFileException) { // If we're about to create a file this exception has been thrown
+                return resolvedPath.toFile().getCanonicalFile().toPath().startsWith(basePath);
             }
             return false;
         }