fix

IGinX-THU · Apr 18, 2024 · 9a03840 · 9a03840
1 parent f128bc3
commit 9a03840
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 8 deletions.
diff --git a/core/src/main/java/cn/edu/tsinghua/iginx/auth/FilePermissionManager.java b/core/src/main/java/cn/edu/tsinghua/iginx/auth/FilePermissionManager.java
@@ -48,6 +48,10 @@ default Optional<Path> normalize(String path) {
       return Optional.of(cheated);
     }
 
+    default boolean testRelativePath(String path) {
+      return !path.contains("..");
+    }
+
     /**
      * cheat CodeQL to not complain about path traversal vulnerability. This method should not be
      * used except you know what you are doing.
@@ -58,23 +62,23 @@ default Optional<Path> normalize(String path) {
     @Deprecated
     default Optional<Path> cheatNormalize(Path path) {
       Path p = path.toAbsolutePath();
-      // split path node
+      // split path nodes
+      String root = p.getRoot().toString();
       String[] nodes = new String[p.getNameCount()];
       for (int i = 0; i < p.getNameCount(); i++) {
         nodes[i] = p.getName(i).toString();
       }
-      // check if any node contains ".." or "/" or "\"
+      // check if any node contains "."
+      if (!testRelativePath(root)) {
+        return Optional.empty();
+      }
       for (String node : nodes) {
-        if (node.contains("..") || node.contains("/") || node.contains("\\")) {
+        if (!testRelativePath(node)) {
           return Optional.empty();
         }
       }
-      // check if path is empty
-      if (nodes.length == 0) {
-        return Optional.empty();
-      }
       // rebuild path
-      Path rebuiltPath = Paths.get(nodes[0], Arrays.copyOfRange(nodes, 1, nodes.length));
+      Path rebuiltPath = Paths.get(root, nodes);
       return Optional.of(rebuiltPath);
     }
   }

diff --git a/core/src/test/java/cn/edu/tsinghua/iginx/auth/FilePermissionManagerTest.java b/core/src/test/java/cn/edu/tsinghua/iginx/auth/FilePermissionManagerTest.java
@@ -8,6 +8,7 @@
 import cn.edu.tsinghua.iginx.conf.FilePermissionConfig;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.Optional;
 import org.apache.commons.configuration2.ex.ConfigurationException;
 import org.junit.Test;
 
@@ -137,4 +138,13 @@ public void testCheckChinese() throws ConfigurationException {
             FileAccessType.WRITE);
     assertFalse(predicate.test(Paths.get("不允许.py")));
   }
+
+  @Test
+  public void testNormalize() {
+    FilePermissionManager.Checker checker = path -> true;
+
+    Optional<Path> p = checker.normalize("test");
+    assertTrue(p.isPresent());
+    assertEquals(Paths.get("test").toAbsolutePath(), p.get());
+  }
 }