jprdonnelly/kestra
1
0
Fork 0
mirror of https://github.com/kestra-io/kestra.git synced 2025-12-19 18:05:41 -05:00
Code Issues Packages Projects Releases Wiki Activity

Add subpath guard function to avoid non-relative subpath parsed URI

Browse Source
This commit is contained in:
Hyoseop Song
2024-11-20 18:16:56 +09:00
committed by Loïc Mathieu
parent e850764403
commit ba0e770a05
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
storage-local/src/main/java/io/kestra/storage/local/LocalStorage.java
View File

@@ -233,14 +233,20 @@ public class LocalStorage implements StorageInterface {
.toList(); .toList();
} }
} }
private URI getKestraUri(String tenantId, Path path) { private URI getKestraUri(String tenantId, Path path) {
Path prefix = (tenantId == null) ? Path prefix = (tenantId == null) ?
basePath.toAbsolutePath() : basePath.toAbsolutePath():
Path.of(basePath.toAbsolutePath().toString(), tenantId); basePath.toAbsolutePath().resolve(tenantId);
subPathParentGuard(path, prefix);
return URI.create("kestra:///" + prefix.relativize(path).toString().replace("\\", "/")); return URI.create("kestra:///" + prefix.relativize(path).toString().replace("\\", "/"));
} }
private void subPathParentGuard(Path path, Path prefix) {
if (!path.toAbsolutePath().startsWith(prefix)) {
throw new IllegalArgumentException("The path must be a subpath of the base path with the tenant ID.");
}
}
private void parentTraversalGuard(URI uri) { private void parentTraversalGuard(URI uri) {
if (uri.toString().contains("..")) { if (uri.toString().contains("..")) {
throw new IllegalArgumentException("File should be accessed with their full path and not using relative '..' path."); throw new IllegalArgumentException("File should be accessed with their full path and not using relative '..' path.");