Changeset 7137

Timestamp:

Apr 22, 2016, 1:31:25 PM (7 years ago)

Author:

Nicklas Nordborg

Message:

Fixes #2003: The static cache should not allow cache keys containing '../'

The validation of keys now include a check for '../'.

As an extra safety the canonical path of the files created from the keys are verified to be sub-paths to the root path of the cache.

File:

• branches/3.7-stable/src/core/net/sf/basedb/util/StaticCache.java (modified) (10 diffs)

branches/3.7-stable/src/core/net/sf/basedb/util/StaticCache.java

@@ -46 +46 @@
 import java.util.regex.Pattern;
 
+import net.sf.basedb.core.BaseException;
 import net.sf.basedb.core.InvalidDataException;
 
@@ -89 +90 @@
   public static boolean isValidKey(String key)
   {
-    return validKey.matcher(key).matches();
+    return validKey.matcher(key).matches() && !key.contains("../");
   }
   
@@ -103 +104 @@
   {
     Pattern invalid = Pattern.compile("[^\\w\\/\\.\\-]");
-    return invalid.matcher(key).replaceAll(replacement);
+    return invalid.matcher(key).replaceAll(replacement).replace("../", replacement);
   }
   
   private final File root;
+  private final String rootPath;
   private final Map<String, LockEntry> locks;
   private boolean disabled;
@@ -118 +120 @@
   {
     this.root = root;
+    try
+    {
+      this.rootPath = root.getCanonicalPath();
+    }
+    catch (IOException ex)
+    {
+      throw new BaseException(ex);
+    }
     this.locks = new WeakHashMap<String, LockEntry>();
     log.info("Creating static cache in directory " + root);
@@ -216 +226 @@
   {
     validateKey(key);
-    File f = new File(root, key);
+    File f = fileFromKey(key);
     return f.exists();
   }
@@ -229 +239 @@
   {
     validateKey(key);
-    File f = new File(root, key);
+    File f = fileFromKey(key);
     return f.exists() ? f.length() : -1;
   }
@@ -452 +462 @@
     validateKey(key);
     log.debug("Delete request for static cache: " + key);
-    File f = new File(root, key);
+    File f = fileFromKey(key);
     if (!f.exists()) 
     {
@@ -478 +488 @@
   }
   
+  private File fileFromKey(String key)
+  {
+    File f = new File(root, key);
+    // The key must result in a file path that is a child to the root path!
+    try
+    {
+      String keyPath = f.getCanonicalPath();
+      if (!keyPath.startsWith(rootPath))
+      {
+        throw new InvalidDataException("Invalid path to cache entry: "+ keyPath);
+      }
+    }
+    catch (IOException ex)
+    {
+      throw new InvalidDataException("Invalid cache key: "+ key, ex);
+    }
+    return f;
+  }
+  
   /**
     Get a lock-safe input stream.
@@ -486 +515 @@
     validateKey(key);
     log.debug("Read request for static cache: " + key);
-    File f = new File(root, key);
+    File f = fileFromKey(key);
     if (!f.exists()) 
     {
@@ -523 +552 @@
     try
     {
-      File f = new File(root, key);
+      File f = fileFromKey(key);
       File dir = f.getParentFile();
       if (!dir.mkdirs() && !dir.isDirectory())