hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-07 01:54:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

[CST-21947] fix security fix

Browse Source 
(cherry picked from commit 6c3274630c)
This commit is contained in:
Stefano Maffei
2025-08-14 12:02:08 +02:00
committed by github-actions[bot]
parent e63652e9d0
commit 41b7c75ad6
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dspace-api/src/main/java/org/dspace/storage/bitstore/DSBitStoreService.java
View File

@@ -19,9 +19,11 @@ import java.security.NoSuchAlgorithmException;
import java.util.List;
import java.util.Map;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Logger;
import org.dspace.content.Bitstream;
import org.dspace.core.Utils;
import org.dspace.services.factory.DSpaceServicesFactory;
/**
* Native DSpace (or "Directory Scatter" if you prefer) asset store.
@@ -252,7 +254,10 @@ public class DSBitStoreService extends BaseBitStoreService {
}
File bitstreamFile = new File(bufFilename.toString());
Path normalizedPath = bitstreamFile.toPath().normalize();
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())) {
String[] allowedAssetstoreRoots = DSpaceServicesFactory.getInstance().getConfigurationService()
.getArrayProperty("assetstore.allowed.roots", new String[]{});
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())
&& !StringUtils.startsWithAny(normalizedPath.toString(), allowedAssetstoreRoots)) {
log.error("Bitstream path outside of assetstore root requested:" +
"bitstream={}, path={}, assetstore={}",
bitstream.getID(), normalizedPath, baseDir.getAbsolutePath());

6
dspace/config/modules/assetstore.cfg
View File

@@ -12,10 +12,10 @@ assetstore.dir = ${dspace.dir}/assetstore
# This value will be used as `incoming` default store inside the `bitstore.xml`
# Possible values are:
# - 0: to use the `localStore`;
# - 1: to use the `s3Store`.
# - 1: to use the `s3Store`.
# If you want to add additional assetstores, they must be added to that bitstore.xml
# and new values should be provided as key-value pairs in the `stores` map of the
# `bitstore.xml` configuration.
# `bitstore.xml` configuration.
assetstore.index.primary = 0
#---------------------------------------------------------------#
@@ -102,3 +102,5 @@ assetstore.s3.awsRegionName =
# The maximum counter value for S3 operations.
# Default: -1 (unlimited) connection is never manualy closed in BitstoreService
# assetstore.jcloud.maxCounter = -1
#assetstore.allowed.roots = /data/assetstore