🛡️ Sentinel: [CRITICAL] Fix path traversal in checksum and UploadId

src/main/java/me/desair/tus/server/upload/disk/AbstractDiskBasedService.java

@@ -6,6 +6,7 @@
 import java.nio.file.Paths;
 import me.desair.tus.server.TusFileUploadService;
 import me.desair.tus.server.upload.UploadId;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.Validate;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -37,15 +38,26 @@ protected Path getPathInStorageDirectory(UploadId id) {
     if (id == null) {
       return null;
     } else {
-      Path path = storagePath.resolve(id.toString());
-      if (!path.normalize().toAbsolutePath().startsWith(storagePath.normalize().toAbsolutePath())) {
+      if (!isSafePathComponent(id.toString())) {
         throw new IllegalArgumentException(
             "Upload ID is not valid and would result in a path traversal");
       }
-      return path;
+      return storagePath.resolve(id.toString());
     }
   }
 
+  protected boolean isSafePathComponent(String component) {
+    if (StringUtils.isBlank(component)) {
+      return false;
+    }
+
+    if (component.contains("/") || component.contains("\\") || component.contains("..")) {
+      return false;
+    }
+
+    return true;
+  }
+
   private synchronized void init() {
     if (!Files.exists(storagePath)) {
       try {

src/main/java/me/desair/tus/server/upload/disk/DiskStorageService.java

@@ -93,6 +93,9 @@ public UploadInfo getUploadInfoByChecksum(String checksum, ChecksumAlgorithm alg
     if (checksum == null || algorithm == null) {
       return null;
     }
+    if (!isSafePathComponent(checksum)) {
+      throw new IOException("The checksum contains an unsafe value");
+    }
     Path checksumFile = getChecksumPath(checksum, algorithm);
     if (Files.exists(checksumFile)) {
       String uploadIdStr =
@@ -219,6 +222,9 @@ public void update(UploadInfo uploadInfo) throws IOException, UploadNotFoundExce
           && !uploadInfo.isUploadInProgress()
           && uploadInfo.getChecksum() != null
           && uploadInfo.getChecksumAlgorithm() != null) {
+        if (!isSafePathComponent(uploadInfo.getChecksum())) {
+          throw new IOException("The checksum contains an unsafe value");
+        }
         // Index the checksum
         Path checksumFile =
             getChecksumPath(uploadInfo.getChecksum(), uploadInfo.getChecksumAlgorithm());
@@ -303,8 +309,12 @@ public void terminateUpload(UploadInfo info) throws UploadNotFoundException, IOE
       if (info.getDuplicatesUploadId() == null
           && info.getChecksum() != null
           && info.getChecksumAlgorithm() != null) {
-        Path checksumFile = getChecksumPath(info.getChecksum(), info.getChecksumAlgorithm());
-        Files.deleteIfExists(checksumFile);
+        try {
+          Path checksumFile = getChecksumPath(info.getChecksum(), info.getChecksumAlgorithm());
+          Files.deleteIfExists(checksumFile);
+        } catch (IOException e) {
+          // Ignore
+        }
       }
       Path uploadPath = getPathInStorageDirectory(info.getId());
       FileUtils.deleteDirectory(uploadPath.toFile());
@@ -448,7 +458,10 @@ private Path getInfoPath(UploadId id) throws UploadNotFoundException {
     return getPathInUploadDir(id, INFO_FILE);
   }
 
-  private Path getChecksumPath(String checksum, ChecksumAlgorithm algorithm) {
+  private Path getChecksumPath(String checksum, ChecksumAlgorithm algorithm) throws IOException {
+    if (!isSafePathComponent(checksum)) {
+      throw new IOException("The checksum contains an unsafe value");
+    }
     return getStoragePath()
         .getParent()
         .resolve("checksums")

src/test/java/me/desair/tus/server/upload/disk/DiskLockingServiceTest.java

@@ -356,20 +356,16 @@ public void testRequestLockReleaseCreatesParentDirectory() throws Exception {
     UploadId id = new UploadId("000003f1-a850-49de-af03-997272d834c9");
     java.lang.reflect.Field urlSafeField = UploadId.class.getDeclaredField("urlSafeValue");
     urlSafeField.setAccessible(true);
-    urlSafeField.set(id, "subdir/000003f1-a850-49de-af03-997272d834c9");
+    urlSafeField.set(id, "000003f1-a850-49de-af03-997272d834c9");
 
     reset(idFactory);
     when(idFactory.readUploadId(org.mockito.Mockito.anyString())).thenReturn(id);
 
-    String uri = "/upload/test/subdir/000003f1-a850-49de-af03-997272d834c9";
+    String uri = "/upload/test/000003f1-a850-49de-af03-997272d834c9";
     service.requestLockRelease(uri);
 
     Path stopFilePath =
-        nestedStorage
-            .resolve("locks")
-            .resolve("subdir")
-            .resolve("subdir")
-            .resolve("000003f1-a850-49de-af03-997272d834c9.stop");
+        nestedStorage.resolve("locks").resolve("000003f1-a850-49de-af03-997272d834c9.stop");
 
     assertTrue(Files.exists(stopFilePath));
     Files.deleteIfExists(stopFilePath);

src/test/java/me/desair/tus/server/upload/disk/DiskStorageServiceTest.java

@@ -651,6 +651,12 @@ public void testGetUploadInfoByChecksumNull() throws Exception {
     assertThat(storageService.getUploadInfoByChecksum("somechecksum", null), is(nullValue()));
   }
 
+  @Test(expected = IOException.class)
+  public void testGetUploadInfoByChecksumUnsafe() throws Exception {
+    storageService.getUploadInfoByChecksum(
+        "../../../etc/passwd", me.desair.tus.server.checksum.ChecksumAlgorithm.SHA256);
+  }
+
   @Test
   public void testGetUploadInfoByChecksumMissingDataFile() throws Exception {
     storageService.setUploadDeduplicationEnabled(true);
@@ -703,6 +709,19 @@ public void testDeduplicationParentNullExpirationUpdate() throws Exception {
     assertThat(parent.getExpirationTimestamp(), is(nullValue()));
   }
 
+  @Test(expected = IOException.class)
+  public void testUnsafeChecksumValue() throws Exception {
+    storageService.setUploadDeduplicationEnabled(true);
+    UploadInfo parent = new UploadInfo();
+    parent.setLength(100L);
+    parent.setOffset(100L);
+    parent = storageService.create(parent, null);
+    parent.setOffset(100L);
+    parent.setChecksum("../../../etc/passwd");
+    parent.setChecksumAlgorithm(me.desair.tus.server.checksum.ChecksumAlgorithm.SHA256);
+    storageService.update(parent);
+  }
+
   private Path getUploadInfoPath(UploadId id) {
     return getStoragePath(id).resolve("info");
   }