未验证 提交 8a45602a 编写于 作者: J Jan S 提交者: GitHub

fix: improve logging messages for zip security errors (#750)(PR #1698)

Logging error messages on invalid file-names or path traversal attacks improved
上级 711419a7
...@@ -49,7 +49,7 @@ public class ResourcesSaver implements Runnable { ...@@ -49,7 +49,7 @@ public class ResourcesSaver implements Runnable {
private void save(ResContainer rc, File outDir) { private void save(ResContainer rc, File outDir) {
File outFile = new File(outDir, rc.getFileName()); File outFile = new File(outDir, rc.getFileName());
if (!ZipSecurity.isInSubDirectory(outDir, outFile)) { if (!ZipSecurity.isInSubDirectory(outDir, outFile)) {
LOG.error("Path traversal attack detected, invalid resource name: {}", outFile.getPath()); LOG.error("Invalid resource name or path traversal attack detected: {}", outFile.getPath());
return; return;
} }
saveToFile(rc, outFile); saveToFile(rc, outFile);
......
...@@ -53,10 +53,10 @@ public class ZipSecurity { ...@@ -53,10 +53,10 @@ public class ZipSecurity {
if (isInSubDirectoryInternal(currentPath, canonical)) { if (isInSubDirectoryInternal(currentPath, canonical)) {
return true; return true;
} }
LOG.error("Path traversal attack detected, invalid name: {}", entryName); LOG.error("Invalid file name or path traversal attack detected: {}", entryName);
return false; return false;
} catch (Exception e) { } catch (Exception e) {
LOG.error("Path traversal attack detected, invalid name: {}", entryName); LOG.error("Invalid file name or path traversal attack detected: {}", entryName);
return false; return false;
} }
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册