mirror of
https://github.com/jenkinsci/jenkins.git
synced 2026-10-30 21:15:23 +00:00
[JENKINS-67063] Revert canonicalization of entries when untarring (#5900)
Co-authored-by: Daniel Beck <daniel-beck@users.noreply.github.com>
This commit is contained in:
1 parent
e8f2ae4e4c
commit
0accf411e9
1 file changed
+2
-3
@@ -2831,14 +2831,13 @@ public final class FilePath implements SerializableOnlyOverRemoting {
|
||||
* Supports large files > 10 GB since 1.627 when this was migrated to use commons-compress.
|
||||
*/
|
||||
private static void readFromTar(String name, File baseDir, InputStream in) throws IOException {
|
||||
baseDir = baseDir.getCanonicalFile();
|
||||
|
||||
// TarInputStream t = new TarInputStream(in);
|
||||
try (TarArchiveInputStream t = new TarArchiveInputStream(in)) {
|
||||
TarArchiveEntry te;
|
||||
while ((te = t.getNextTarEntry()) != null) {
|
||||
File f = new File(baseDir, te.getName()).getCanonicalFile();
|
||||
if (!f.toPath().startsWith(baseDir.toPath())) {
|
||||
File f = new File(baseDir, te.getName());
|
||||
if (!f.toPath().normalize().startsWith(baseDir.toPath())) {
|
||||
throw new IOException(
|
||||
"Tar " + name + " contains illegal file name that breaks out of the target directory: " + te.getName());
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user