zhuyijun/nacos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

🐛 Uncontrolled data used in path expression (#11822)

Browse Source 
https://github.com/alibaba/nacos/issues/11821
This commit is contained in:
不务正业 2024-03-15 14:05:20 +08:00 committed by GitHub
parent 0d7fcff261
commit c86147b6ab
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
common/src/main/java/com/alibaba/nacos/common/utils/StringUtils.java
View File

@ -48,11 +48,11 @@ public class StringUtils {
private static final String[] EMPTY_STRING_ARRAY = {}; private static final String[] EMPTY_STRING_ARRAY = {};
private static final String TOP_PATH = ".."; public static final String TOP_PATH = "..";
private static final String FOLDER_SEPARATOR = "/"; public static final String FOLDER_SEPARATOR = "/";
private static final String WINDOWS_FOLDER_SEPARATOR = "\\"; public static final String WINDOWS_FOLDER_SEPARATOR = "\\";
/** /**
* <p>Create a string with encoding format as utf8.</p> * <p>Create a string with encoding format as utf8.</p>

7
console/src/main/java/com/alibaba/nacos/console/controller/ServerStateController.java
View File

@ -34,6 +34,10 @@ import java.io.File;
import java.util.HashMap; import java.util.HashMap;
import java.util.Map; import java.util.Map;
import static com.alibaba.nacos.common.utils.StringUtils.FOLDER_SEPARATOR;
import static com.alibaba.nacos.common.utils.StringUtils.TOP_PATH;
import static com.alibaba.nacos.common.utils.StringUtils.WINDOWS_FOLDER_SEPARATOR;
/** /**
* Server state controller. * Server state controller.
* *
@ -66,6 +70,9 @@ public class ServerStateController {
public RestResult<String> getAnnouncement( public RestResult<String> getAnnouncement(
@RequestParam(required = false, name = "language", defaultValue = "zh-CN") String language) { @RequestParam(required = false, name = "language", defaultValue = "zh-CN") String language) {
String file = ANNOUNCEMENT_FILE.substring(0, ANNOUNCEMENT_FILE.length() - 5) + "_" + language + ".conf"; String file = ANNOUNCEMENT_FILE.substring(0, ANNOUNCEMENT_FILE.length() - 5) + "_" + language + ".conf";
if (file.contains(TOP_PATH) || file.contains(FOLDER_SEPARATOR) || file.contains(WINDOWS_FOLDER_SEPARATOR)) {
throw new IllegalArgumentException("Invalid filename");
}
File announcementFile = new File(EnvUtil.getConfPath(), file); File announcementFile = new File(EnvUtil.getConfPath(), file);
String announcement = null; String announcement = null;
if (announcementFile.exists() && announcementFile.isFile()) { if (announcementFile.exists() && announcementFile.isFile()) {