未验证 提交 8a45602a 编写于 作者: J Jan S 提交者: GitHub

fix: improve logging messages for zip security errors (#750)(PR #1698)

Logging error messages on invalid file-names or path traversal attacks improved
上级 711419a7
......@@ -49,7 +49,7 @@ public class ResourcesSaver implements Runnable {
private void save(ResContainer rc, File outDir) {
File outFile = new File(outDir, rc.getFileName());
if (!ZipSecurity.isInSubDirectory(outDir, outFile)) {
LOG.error("Path traversal attack detected, invalid resource name: {}", outFile.getPath());
LOG.error("Invalid resource name or path traversal attack detected: {}", outFile.getPath());
return;
}
saveToFile(rc, outFile);
......
......@@ -53,10 +53,10 @@ public class ZipSecurity {
if (isInSubDirectoryInternal(currentPath, canonical)) {
return true;
}
LOG.error("Path traversal attack detected, invalid name: {}", entryName);
LOG.error("Invalid file name or path traversal attack detected: {}", entryName);
return false;
} catch (Exception e) {
LOG.error("Path traversal attack detected, invalid name: {}", entryName);
LOG.error("Invalid file name or path traversal attack detected: {}", entryName);
return false;
}
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册