From 0accf411e93036337f2fc2f1a0872cfafa947da1 Mon Sep 17 00:00:00 2001 From: Daniel Beck <1831569+daniel-beck@users.noreply.github.com> Date: Tue, 9 Nov 2021 09:07:18 +0100 Subject: [PATCH] [JENKINS-67063] Revert canonicalization of entries when untarring (#5900) Co-authored-by: Daniel Beck --- core/src/main/java/hudson/FilePath.java | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/core/src/main/java/hudson/FilePath.java b/core/src/main/java/hudson/FilePath.java index 9ecbe01075..8a71b56157 100644 --- a/core/src/main/java/hudson/FilePath.java +++ b/core/src/main/java/hudson/FilePath.java @@ -2831,14 +2831,13 @@ public final class FilePath implements SerializableOnlyOverRemoting { * Supports large files > 10 GB since 1.627 when this was migrated to use commons-compress. */ private static void readFromTar(String name, File baseDir, InputStream in) throws IOException { - baseDir = baseDir.getCanonicalFile(); // TarInputStream t = new TarInputStream(in); try (TarArchiveInputStream t = new TarArchiveInputStream(in)) { TarArchiveEntry te; while ((te = t.getNextTarEntry()) != null) { - File f = new File(baseDir, te.getName()).getCanonicalFile(); - if (!f.toPath().startsWith(baseDir.toPath())) { + File f = new File(baseDir, te.getName()); + if (!f.toPath().normalize().startsWith(baseDir.toPath())) { throw new IOException( "Tar " + name + " contains illegal file name that breaks out of the target directory: " + te.getName()); }