Fix regression when extracting tar archive #816
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…on directory Commit 93d77ff introduced a check that files extracted from a tar archive will not be written outside of the destination directory. Unfortunately it also introduced a regression prventing the extraction of any tar archive when the path to the destination directory contains a symbolic link. For example on a jenkins agent where /var/lib/jenkins is a symbolic link to /data/jenkins and a job tries to extact nodejs to /var/lib/jenkins/workspace/example-project/target/node/tmp. The old code would then check if canonical path to a tar entry like /data/jenkins/workspace/example-project/target/node/tmp/XXX starts with /var/lib/jenkins/workspace/example-project/target/node/tmp which always fails. This commit compares the canonical extraction paths of the tar entries with the canonical path of the destination directory, which fixes the regression and still checks that no file is extracted outside of the destination directory.
|
Could this please get merged? I cannot build my projects anymore this is kind of really bad... |
|
Ok, looks good. |
crisu
reviewed
Dec 2, 2019
| while (tarEntry != null) { | ||
| // Create a file for this tarEntry | ||
| final File destPath = new File(destinationDirectory + File.separator + tarEntry.getName()); | ||
| prepDestination(destPath, tarEntry.isDirectory()); | ||
| if (!destPath.getCanonicalPath().startsWith(destinationDirectory)) { | ||
| if (!destPath.getCanonicalPath().startsWith(canonicalDestinationDirectory)) { |
There was a problem hiding this comment.
this fix was lost in 26 aug 2019
|
i think this fix was lost in 26 August |
|
There we go, 1.9.0 is released, merry christmas! 🎅 ❄️ 🎄 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Commit 93d77ff introduced a check that files extracted from a tar archive will not be written outside of the destination directory. Unfortunately it also introduced a regression prventing the extraction of any tar archive when the path to the destination directory contains a symbolic link.
For example on a jenkins agent where
/var/lib/jenkinsis a symbolic link to/data/jenkinsand a job tries to extact nodejs to/var/lib/jenkins/workspace/example-project/target/node/tmp. The old code would then check if canonical path to a tar entry like/data/jenkins/workspace/example-project/target/node/tmp/XXXstarts with/var/lib/jenkins/workspace/example-project/target/node/tmpwhich always fails.The new check compares the canonical extraction paths of the tar entries with the canonical path of the destination directory. This also works when the destination directory path contains a symbolic link and still protects against extracting files outside the destination directory.