-
Notifications
You must be signed in to change notification settings - Fork 18
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Introduce and make use of IOHelper.securePath() to further harden against path traversal threats. * Limit DirectUrlWebContentProvider to only handle http and https URLs. * Update release notes * Rename method from securePath to secureFilePath to better clarify scope/purpose * fixed typo in comment Co-authored-by: chrimih <[email protected]> --------- Co-authored-by: chrimih <[email protected]>
- Loading branch information
Showing
11 changed files
with
264 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
53 changes: 53 additions & 0 deletions
53
core/src/main/java/com/devonfw/tools/solicitor/componentinfo/scancode/MultilineHelper.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| /** | ||
| * SPDX-License-Identifier: Apache-2.0 | ||
| */ | ||
| package com.devonfw.tools.solicitor.componentinfo.scancode; | ||
|
|
||
| import java.util.regex.Matcher; | ||
| import java.util.regex.Pattern; | ||
|
|
||
| /** | ||
| * A helper class which supports extracting a range of lines from a given (multiline) string. | ||
| */ | ||
| public class MultilineHelper { | ||
|
|
||
| /** | ||
| * Constructor. Prevents instantiation. | ||
| * | ||
| */ | ||
| private MultilineHelper() { | ||
|
|
||
| } | ||
|
|
||
| /** | ||
| * Extracts a range of lines from the given (multiline) input. | ||
| * | ||
| * @param input the multiline input | ||
| * @param lineInfo lines to extract, given as <code>#L17-L20</code>. <code>null</code> indicates that the whole input | ||
| * should be returned. | ||
| * @return the extracted lines. | ||
| */ | ||
| public static String possiblyExtractLines(String input, String lineInfo) { | ||
|
|
||
| if (lineInfo == null) { | ||
| return input; | ||
| } | ||
| Pattern pattern = Pattern.compile("#L(\\d+)(-L(\\d+))?"); | ||
| Matcher matcher = pattern.matcher(lineInfo); | ||
| if (matcher.find()) { | ||
| int startLine = Integer.parseInt(matcher.group(1)); | ||
| int endLine = Integer.parseInt(matcher.group(3) != null ? matcher.group(3) : matcher.group(1)); | ||
| String[] splitted = input.split("\\n"); | ||
| StringBuffer result = new StringBuffer(); | ||
| for (int i = 0; i < splitted.length; i++) { | ||
| if (i + 1 >= startLine && i + 1 <= endLine) { | ||
| result.append(splitted[i]).append("\n"); | ||
| } | ||
| } | ||
| return result.toString(); | ||
| } else { | ||
| throw new IllegalStateException("Regex did not find line info - this seems to be a bug."); | ||
| } | ||
| } | ||
|
|
||
| } |
69 changes: 69 additions & 0 deletions
69
core/src/test/java/com/devonfw/tools/solicitor/common/IOHelperTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| package com.devonfw.tools.solicitor.common; | ||
|
|
||
| import static org.junit.jupiter.api.Assertions.assertEquals; | ||
| import static org.junit.jupiter.api.Assertions.assertThrows; | ||
|
|
||
| import java.io.File; | ||
|
|
||
| import org.junit.jupiter.api.BeforeEach; | ||
| import org.junit.jupiter.api.Test; | ||
|
|
||
| /** | ||
| * Tests for {@link IOHelper}. | ||
| * | ||
| */ | ||
| class IOHelperTest { | ||
|
|
||
| /** | ||
| * @throws java.lang.Exception | ||
| */ | ||
| @BeforeEach | ||
| void setUp() throws Exception { | ||
|
|
||
| } | ||
|
|
||
| /** | ||
| * Test method for | ||
| * {@link com.devonfw.tools.solicitor.common.IOHelper#secureFilePath(java.lang.String, java.lang.String[])}. | ||
| */ | ||
| @Test | ||
| void testSecureFilePath() { | ||
|
|
||
| assertEquals(fixSep("base"), IOHelper.secureFilePath("base")); | ||
| assertEquals(fixSep("base/r1"), IOHelper.secureFilePath("base", "r1")); | ||
| assertEquals(fixSep("base/r1/r2"), IOHelper.secureFilePath("base", "r1", "r2")); | ||
| assertEquals(fixSep("base/r1/r2"), IOHelper.secureFilePath("base", "r1///", "r2/././")); | ||
| assertEquals(fixSep("/base/r1/r2"), IOHelper.secureFilePath("/base", "r1///", "r2/././")); | ||
|
|
||
| assertThrows(IllegalArgumentException.class, () -> { | ||
| IOHelper.secureFilePath("base", "/r1", "r2"); | ||
| }); | ||
|
|
||
| assertThrows(IllegalArgumentException.class, () -> { | ||
| IOHelper.secureFilePath("base", "../r1", "r2"); | ||
| }); | ||
|
|
||
| assertThrows(IllegalArgumentException.class, () -> { | ||
| IOHelper.secureFilePath("base", "r1", "../r2"); | ||
| }); | ||
|
|
||
| assertEquals(fixSep("base/r1/r2"), IOHelper.secureFilePath("base", "a/../r1", "r2")); | ||
|
|
||
| assertThrows(IllegalArgumentException.class, () -> { | ||
| IOHelper.secureFilePath("base", "a/../../r1", "r2"); | ||
| }); | ||
| } | ||
|
|
||
| /** | ||
| * Returns the given strings with all occurrences of <code>/</code> or <code>\\</code> to be replaced by the system | ||
| * dependent file separator character. This is required to handle differences between Windows and Unix. | ||
| * | ||
| * @param input the origin string | ||
| * @return the fixed string | ||
| */ | ||
| private static String fixSep(String input) { | ||
|
|
||
| return input.replace('/', File.separatorChar).replace('\\', File.separatorChar); | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.