hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-07 18:14:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

[CST-21947] fix security fix

Browse Source 
(cherry picked from commit 6c3274630c)
This commit is contained in:
Stefano Maffei
2025-08-14 12:02:08 +02:00
committed by github-actions[bot]
parent e63652e9d0
commit 41b7c75ad6
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dspace-api/src/main/java/org/dspace/storage/bitstore/DSBitStoreService.java
View File

@@ -19,9 +19,11 @@ import java.security.NoSuchAlgorithmException;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Logger; import org.apache.logging.log4j.Logger;
import org.dspace.content.Bitstream; import org.dspace.content.Bitstream;
import org.dspace.core.Utils; import org.dspace.core.Utils;
import org.dspace.services.factory.DSpaceServicesFactory;
/** /**
* Native DSpace (or "Directory Scatter" if you prefer) asset store. * Native DSpace (or "Directory Scatter" if you prefer) asset store.
@@ -252,7 +254,10 @@ public class DSBitStoreService extends BaseBitStoreService {
} }
File bitstreamFile = new File(bufFilename.toString()); File bitstreamFile = new File(bufFilename.toString());
Path normalizedPath = bitstreamFile.toPath().normalize(); Path normalizedPath = bitstreamFile.toPath().normalize();
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())) { String[] allowedAssetstoreRoots = DSpaceServicesFactory.getInstance().getConfigurationService()
.getArrayProperty("assetstore.allowed.roots", new String[]{});
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())
&& !StringUtils.startsWithAny(normalizedPath.toString(), allowedAssetstoreRoots)) {
log.error("Bitstream path outside of assetstore root requested:" + log.error("Bitstream path outside of assetstore root requested:" +
"bitstream={}, path={}, assetstore={}", "bitstream={}, path={}, assetstore={}",
bitstream.getID(), normalizedPath, baseDir.getAbsolutePath()); bitstream.getID(), normalizedPath, baseDir.getAbsolutePath());

2
dspace/config/modules/assetstore.cfg
View File

@@ -102,3 +102,5 @@ assetstore.s3.awsRegionName =
# The maximum counter value for S3 operations. # The maximum counter value for S3 operations.
# Default: -1 (unlimited) connection is never manualy closed in BitstoreService # Default: -1 (unlimited) connection is never manualy closed in BitstoreService
# assetstore.jcloud.maxCounter = -1 # assetstore.jcloud.maxCounter = -1
#assetstore.allowed.roots = /data/assetstore