[java-identity-provider] branch main updated: IDP-2297 Explore extending the Plugin and Module Infrastructure to allow Jetty installation

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=25af4ee2b7a13664a277dd6acd2989394dc1d3c6

The following commit(s) were added to refs/heads/main by this push:
     new 25af4ee2b IDP-2297 Explore extending the Plugin and Module Infrastructure to allow Jetty installation
25af4ee2b is described below

commit 25af4ee2b7a13664a277dd6acd2989394dc1d3c6
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Fri Aug 9 15:02:53 2024 +0100

    IDP-2297 Explore extending the Plugin and Module Infrastructure to allow Jetty installation
    
    https://shibboleth.atlassian.net/browse/IDP-2297
    
    Add blade guard to stop a package partying outside the bounds of the IdP installation
---
 .../net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java    | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
index 48cbbd8be..c8acf7795 100644
--- a/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
+++ b/idp-installer/src/main/java/net/shibboleth/idp/installer/plugin/impl/PluginInstaller.java
@@ -532,6 +532,11 @@ public final class PluginInstaller extends AbstractInitializableComponent implem
             try {
                 final Path to = idpHome.resolve(pack.getDestinationName());
                 assert to != null;
+                if (!to.startsWith(idpHome.toString())) {
+                    LOG.error("Package {} attempted to create file outside of IdP installation: {}", pack.getDestinationName(), to);
+                    throw new BuildException("Plugin package asked to create file outside of IdP installation");
+                }
+                
                 if (Files.exists(to)) {
                     InstallerSupport.renameToTree(getIdpHome(),
                                                   renameTarget,

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.