fix path traversal so static analysis can recognize it

This commit is contained in:
Jonathan Shook 2022-03-11 10:00:23 -06:00
parent 81c7d47885
commit 38688dd6c6

View File

@ -151,6 +151,9 @@ public class WorkSpace {
}
private void assertLegalWorkspacePath(Path target) {
if (!target.normalize().startsWith(this.workspacePath)) {
throw new RuntimeException("workspace path '" + target + "' contains path traversal");
}
if (target.toString().contains("..")) {
throw new RuntimeException("Possible path injection:" + target);
}