Eclipse/jetty.project
1
0
Fork 0
mirror of https://github.com/jetty/jetty.project.git synced 2025-03-01 03:19:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

464556 - Restrict start module downloads to ${jetty.base} paths only

Browse Source 
+ Restrict [files] section references (download/uri/maven) to
  output only in ${jetty.base} tree
This commit is contained in:
Joakim Erdfelt 2015-04-13 16:46:46 -07:00
parent cea577bd17
commit 0e2b1856b5
3 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
jetty-start/src/main/java/org/eclipse/jetty/start/BaseBuilder.java
View File

@ -251,6 +251,11 @@ public class BaseBuilder
{
if (startArgs.isDownload() && (arg.uri != null))
{
if (!file.startsWith(baseHome.getBasePath()))
{
throw new IOException("For security reasons, Jetty start is unable to process file resource not in ${jetty.base} - " + file);
}
URI uri = URI.create(arg.uri);
// Process via initializers

2
jetty-start/src/main/java/org/eclipse/jetty/start/BaseHome.java
View File

@ -200,7 +200,7 @@ public class BaseHome
*/
public Path getBasePath(String path)
{
return baseDir.resolve(path);
return baseDir.resolve(path).normalize().toAbsolutePath();
}
public ConfigSources getConfigSources()

5
jetty-start/src/main/java/org/eclipse/jetty/start/fileinits/MavenLocalRepoFileInitializer.java
View File

@ -108,6 +108,11 @@ public class MavenLocalRepoFileInitializer extends UriFileInitializer implements
return true;
}
if (!file.startsWith(baseHome.getBasePath()))
{
throw new IOException("For security reasons, Jetty start is unable to process maven file resource not in ${jetty.base} - " + file);
}
// If using local repository
if (this.localRepositoryDir != null)
{