[java-identity-provider] 01/02: IDP-1595 Police plugin locations

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=ba71284e4c6c7f1afe6c6a62f5a7cb28275123a2

commit ba71284e4c6c7f1afe6c6a62f5a7cb28275123a2
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Wed Jul 22 15:15:46 2020 +0100

    IDP-1595 Police plugin locations
    
    https://issues.shibboleth.net/jira/browse/IDP-1595
---
 .../idp/installer/plugin/impl/PluginInstaller.java           | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
index 98c9582d4..298c61463 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
@@ -77,6 +77,9 @@ import net.shibboleth.utilities.java.support.resource.Resource;
  */
 public final class PluginInstaller extends AbstractInitializableComponent implements AutoCloseable {
 
+    /** Where we cannot install. */
+    private static List<String> disallowedPaths = List.of("dist", "system", "webapp");
+
     /** Class logger. */
     @Nonnull private final Logger log = LoggerFactory.getLogger(PluginInstaller.class);
 
@@ -100,7 +103,7 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
 
     /** The callback before we download a file. */
     @Nonnull private Predicate<Pair<URL,Path>> acceptDownload = Predicates.alwaysFalse();
-
+    
     /** The actual distribution. */
     private Path distribution;
 
@@ -273,6 +276,13 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
      */
     private void installFiles() throws BuildException {
         for (final Path p : description.getFilePathsToCopy()) {
+            for (final String disallowedPath : disallowedPaths) {
+                if (p.startsWith(disallowedPath)) {
+                    log.error("Path {} contained disallowed location", p);
+                    throw new BuildException("Copy to banned location");
+                }
+            }
+
             final Path from = distribution.resolve(p);
             final Path to = idpHome.resolve(p);
             if (Files.exists(to)) {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.