From 48b7d1ebb1138074356da9790fb20f3219c887a4 Mon Sep 17 00:00:00 2001 From: Hang Chen Date: Mon, 4 Mar 2024 12:07:49 +0800 Subject: [PATCH] Add filename check for unTar (#4222) * add filename check for unTar * update code --- .../bookkeeper/tests/integration/utils/DockerUtils.java | 6 +++++- .../tests/integration/utils/MavenClassLoader.java | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java index bae9057fa1b..a3b8778946a 100644 --- a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java +++ b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/DockerUtils.java @@ -135,7 +135,11 @@ public static void dumpContainerLogDirToTarget(DockerClient docker, String conta TarArchiveEntry entry = stream.getNextTarEntry(); while (entry != null) { if (entry.isFile()) { - File output = new File(getTargetDirectory(containerId), entry.getName().replace("/", "-")); + File targetDir = getTargetDirectory(containerId); + File output = new File(targetDir, entry.getName().replace("/", "-")); + if (!output.toPath().normalize().startsWith(targetDir.toPath())) { + throw new IOException("Bad zip entry"); + } try (FileOutputStream os = new FileOutputStream(output)) { byte[] block = new byte[readBlockSize]; int read = stream.read(block, 0, readBlockSize); diff --git a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java index 2b1fabf6bed..d77c3920acf 100644 --- a/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java +++ b/tests/integration-tests-utils/src/main/java/org/apache/bookkeeper/tests/integration/utils/MavenClassLoader.java @@ -367,6 +367,10 @@ private static void unTar(final File inputFile, final File outputDir) throws Exc TarArchiveEntry entry; while ((entry = (TarArchiveEntry) debInputStream.getNextEntry()) != null) { final File outputFile = new File(outputDir, entry.getName()); + if (!outputFile.toPath().normalize().startsWith(outputDir.toPath())) { + throw new IOException("Bad zip entry"); + } + if (!outputFile.getParentFile().exists()) { outputFile.getParentFile().mkdirs(); }