vuln-fix: Partial Path Traversal Vulnerability

JLLeitschuh · TeamModerne · JLLeitschuh · commit b09c6a4be2a8 · 2022-09-21T15:22:43.000Z
This fixes a partial path traversal vulnerability. Replaces `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`, which is vulnerable to partial path traversal attacks, with the more secure `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())`. To demonstrate this vulnerability, consider `"/usr/outnot".startsWith("/usr/out")`. The check is bypassed although `/outnot` is not under the `/out` directory. It's important to understand that the terminating slash may be removed when using various `String` representations of the `File` object. For example, on Linux, `println(new File("/var"))` will print `/var`, but `println(new File("/var", "/")` will print `/var/`; however, `println(new File("/var", "/").getCanonicalPath())` will print `/var`. Weakness: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Severity: Medium CVSSS: 6.1 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.PartialPathTraversalVulnerability) Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Bug-tracker: JLLeitschuh/security-research#13 Co-authored-by: Moderne <team@moderne.io>
diff --git a/common/src/main/java/net/adoptopenjdk/icedteaweb/io/FileUtils.java b/common/src/main/java/net/adoptopenjdk/icedteaweb/io/FileUtils.java
@@ -338,7 +338,7 @@ public static void recursiveDelete(File file, File base) throws IOException {
             return;
         }
 
-        if (!(file.getCanonicalPath().startsWith(base.getCanonicalPath()))) {
+        if (!(file.getCanonicalFile().toPath().startsWith(base.getCanonicalFile().toPath()))) {
             throw new IOException("Trying to delete a file outside Netx's basedir: "
                     + file.getCanonicalPath());
         }

Original file line number	Diff line number	Diff line change
`@@ -338,7 +338,7 @@ public static void recursiveDelete(File file, File base) throws IOException {`
`338`	`338`	`return;`
`339`	`339`	`}`
`340`	`340`
`341`		`- if (!(file.getCanonicalPath().startsWith(base.getCanonicalPath()))) {`
	`341`	`+ if (!(file.getCanonicalFile().toPath().startsWith(base.getCanonicalFile().toPath()))) {`
`342`	`342`	`throw new IOException("Trying to delete a file outside Netx's basedir: "`
`343`	`343`	`+ file.getCanonicalPath());`
`344`	`344`	`}`