hazza/DSpace
1
0
Fork 0
mirror of https://github.com/DSpace/DSpace.git synced 2025-10-08 02:24:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #11171 from 4Science/task/main/DURACOM-392

Browse Source 
Error in file upload after security fixes
This commit is contained in:
Tim Donohue
2025-09-08 12:12:33 -05:00
committed by GitHub
parent d0e84e5080 6234103d2c
commit a05267e114
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
dspace-api/src/main/java/org/dspace/storage/bitstore/DSBitStoreService.java
View File

@@ -19,9 +19,11 @@ import java.security.NoSuchAlgorithmException;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.Logger; import org.apache.logging.log4j.Logger;
import org.dspace.content.Bitstream; import org.dspace.content.Bitstream;
import org.dspace.core.Utils; import org.dspace.core.Utils;
import org.dspace.services.factory.DSpaceServicesFactory;
/** /**
* Native DSpace (or "Directory Scatter" if you prefer) asset store. * Native DSpace (or "Directory Scatter" if you prefer) asset store.
@@ -252,7 +254,10 @@ public class DSBitStoreService extends BaseBitStoreService {
} }
File bitstreamFile = new File(bufFilename.toString()); File bitstreamFile = new File(bufFilename.toString());
Path normalizedPath = bitstreamFile.toPath().normalize(); Path normalizedPath = bitstreamFile.toPath().normalize();
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())) { String[] allowedAssetstoreRoots = DSpaceServicesFactory.getInstance().getConfigurationService()
.getArrayProperty("assetstore.allowed.roots", new String[]{});
if (!normalizedPath.startsWith(baseDir.getAbsolutePath())
&& !StringUtils.startsWithAny(normalizedPath.toString(), allowedAssetstoreRoots)) {
log.error("Bitstream path outside of assetstore root requested:" + log.error("Bitstream path outside of assetstore root requested:" +
"bitstream={}, path={}, assetstore={}", "bitstream={}, path={}, assetstore={}",
bitstream.getID(), normalizedPath, baseDir.getAbsolutePath()); bitstream.getID(), normalizedPath, baseDir.getAbsolutePath());

3
dspace/config/modules/assetstore.cfg
View File

@@ -18,6 +18,9 @@ assetstore.dir = ${dspace.dir}/assetstore
# `bitstore.xml` configuration. # `bitstore.xml` configuration.
assetstore.index.primary = 0 assetstore.index.primary = 0
#if the assetstore path is symbolic link, use this configuration to allow that path.
#assetstore.allowed.roots = /data/assetstore
#---------------------------------------------------------------# #---------------------------------------------------------------#
#-------------- Amazon S3 Specific Configurations --------------# #-------------- Amazon S3 Specific Configurations --------------#
#---------------------------------------------------------------# #---------------------------------------------------------------#