inteligr8/alfresco-transform-core
1
0
Fork 0
mirror of https://github.com/Alfresco/alfresco-transform-core.git synced 2026-09-16 18:12:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

ACS-11995 Fix CodeQL Issues (#1288)

Browse Source
This commit is contained in:
tathagta15
2026-06-17 16:37:15 +05:30
committed by GitHub
parent eda4462a92
commit 0641c29b07
16 changed files with 147 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deprecated/alfresco-transformer-base/src/main/java/org/alfresco/transformer/fs/FileManager.java
+34 -9
View File
@@ -83,12 +83,14 @@ public class FileManager
{
filename = checkFilename(false, filename);
LogEntry.setTarget(filename);
return TempFileProvider.createTempFile("target_", "_" + filename);
File created = TempFileProvider.createTempFile("target_", "_" + filename);
return assertInsideTempDir(created);
}
public static void deleteFile(final File file) throws Exception
{
if (!file.delete())
final File safeFile = assertInsideTempDir(file);
if (!safeFile.delete())
{
throw new Exception("Failed to delete file");
}
@@ -105,8 +107,8 @@ public class FileManager
*/
private static String checkFilename(boolean source, String filename)
{
filename = getFilename(filename);
if (filename == null || filename.isEmpty())
filename = filename == null ? "" : new File(filename).getName();
if (filename.isEmpty())
{
String sourceOrTarget = source ? "source" : "target";
HttpStatus statusCode = source ? BAD_REQUEST : INTERNAL_SERVER_ERROR;
@@ -115,11 +117,32 @@ public class FileManager
return filename;
}
private static void save(MultipartFile multipartFile, File file)
private static File assertInsideTempDir(File candidate)
{
try
{
Files.copy(multipartFile.getInputStream(), file.toPath(),
File tempRoot = TempFileProvider.getTempDir();
String candidateCanonical = candidate.getCanonicalPath();
String parentCanonical = tempRoot.getCanonicalPath();
if (!candidateCanonical.startsWith(parentCanonical + File.separator)
&& !candidateCanonical.equals(parentCanonical))
{
throw new TransformException(INTERNAL_SERVER_ERROR, "Resolved file escapes the temp directory");
}
return new File(candidateCanonical);
}
catch (IOException e)
{
throw new TransformException(INTERNAL_SERVER_ERROR, "Unable to resolve canonical path", e);
}
}
private static void save(MultipartFile multipartFile, File file)
{
final File safeFile = assertInsideTempDir(file);
try
{
Files.copy(multipartFile.getInputStream(), safeFile.toPath(),
StandardCopyOption.REPLACE_EXISTING);
}
catch (IOException e)
@@ -130,9 +153,10 @@ public class FileManager
public static void save(Resource body, File file)
{
final File safeFile = assertInsideTempDir(file);
try
{
Files.copy(body.getInputStream(), file.toPath(), StandardCopyOption.REPLACE_EXISTING);
Files.copy(body.getInputStream(), safeFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
}
catch (IOException e)
{
@@ -142,9 +166,10 @@ public class FileManager
private static Resource load(File file)
{
final File safeFile = assertInsideTempDir(file);
try
{
Resource resource = new UrlResource(file.toURI());
Resource resource = new UrlResource(safeFile.toURI());
if (resource.exists() || resource.isReadable())
{
return resource;
@@ -222,7 +247,7 @@ public class FileManager
String filename = multipartFile.getOriginalFilename();
long size = multipartFile.getSize();
filename = checkFilename(true, filename);
File file = TempFileProvider.createTempFile("source_", "_" + filename);
File file = assertInsideTempDir(TempFileProvider.createTempFile("source_", "_" + filename));
request.setAttribute(SOURCE_FILE, file);
save(multipartFile, file);
LogEntry.setSource(filename, size);