[java-identity-provider] branch main updated: Expand set of suspect path checks.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=52af9b190d09b04b56bbf8efee3c714c3b625329

The following commit(s) were added to refs/heads/main by this push:
       new  52af9b190 Expand set of suspect path checks.
52af9b190 is described below

commit 52af9b190d09b04b56bbf8efee3c714c3b625329
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 1 21:57:45 2020 -0400

    Expand set of suspect path checks.
---
 .../main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java b/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
index 36928391e..79e76f070 100644
--- a/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
+++ b/idp-admin-api/src/main/java/net/shibboleth/idp/module/PropertyDrivenIdPModule.java
@@ -148,7 +148,8 @@ public class PropertyDrivenIdPModule extends AbstractIdPModule {
                         moduleProperties.getProperty(getId() + renumstr + MODULE_REPLACE_PROPERTY, "false"));
                 
                 final Path destPath = Path.of(dest);
-                if (dest.contains("..") || destPath.isAbsolute()) {
+                if (dest.contains("..") || destPath.isAbsolute() || destPath.startsWith("/") ||
+                        destPath.startsWith("\\")) {
                     throw new ModuleException("Module contained a suspect resource destination");
                 }
                 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.