Merge pull request from GHSA-fvf5-grm7-538p

CureKit-GHSA-fvf5-grm7-538p adding trailing separator to base dir if …
whitesource · May 15, 2022 · af35e87 · af35e87
2 parents d6ac3c3 + 77e276d
commit af35e87
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 14 deletions.
diff --git a/.idea/libraries/Maven__org_owasp_encoder_encoder_1_2_3.xml b/.idea/libraries/Maven__org_owasp_encoder_encoder_1_2_3.xml
diff --git a/src/main/java/io/whitesource/cure/FileSecurityUtils.java b/src/main/java/io/whitesource/cure/FileSecurityUtils.java
@@ -22,7 +22,7 @@ public static boolean isFileOutsideDir(
           @NonNull final String filePath, @NonNull final String baseDirPath) throws IOException {
     File file = new File(filePath);
     File baseDir = new File(baseDirPath);
-    return !file.getCanonicalPath().startsWith(baseDir.getCanonicalPath());
+    return !file.getCanonicalFile().toPath().startsWith(baseDir.getCanonicalFile().toPath());
   }
 
   /**

diff --git a/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java b/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java
@@ -50,6 +50,13 @@ void normalize_validInput_successfullyWithResult() {
     Assertions.assertEquals(expectedResult, actualResult);
   }
 
+  @Test
+  void isFileOutsideDirStartsWithTest() throws IOException {
+    String taintedInput = "/usr/foo/../foo-bar/bar";
+    String baseDir = "/usr/foo";
+    Assertions.assertTrue(FileSecurityUtils.isFileOutsideDir(taintedInput, baseDir));
+  }
+
   @Test
   void normalize_null_successfully() {
     Assertions.assertNull(FileSecurityUtils.normalize(null));