chore: fix vulnerability

pagopa · Apr 4, 2024 · df80734 · df80734
1 parent 231eae1
commit df80734
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/src/main/java/it/gov/pagopa/gpd/upload/service/BlobService.java b/src/main/java/it/gov/pagopa/gpd/upload/service/BlobService.java
@@ -158,6 +158,12 @@ private File unzip(CompletedFileUpload file) {
 
                     // Disable auto-execution for extracted files
                     outputFile = new File(sanitizedOutputPath);
+
+                    if (!outputFile.toPath().normalize().startsWith(destinationDirectory)) {
+                        log.error("[Error][BlobService@unzip] Bad zip entry: the normalized file path does not start with the destination directory");
+                        throw new AppException(HttpStatus.BAD_REQUEST, "INVALID FILE", "Bad zip entry");
+                    }
+
                     boolean executableOff = outputFile.setExecutable(false);
                     if(!executableOff) {
                         log.error("[Error][BlobService@unzip] The underlying file system does not implement an execution permission and the operation failed.");

diff --git a/src/test/java/it/gov/pagopa/gpd/upload/controller/FileUploadControllerTest.java b/src/test/java/it/gov/pagopa/gpd/upload/controller/FileUploadControllerTest.java
@@ -20,8 +20,12 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.attribute.PosixFilePermissions;
+import java.util.EnumSet;
 
 import static io.micronaut.http.HttpStatus.*;
+import static java.nio.file.attribute.PosixFilePermission.*;
 import static org.junit.jupiter.api.Assertions.*;
 import static org.mockito.ArgumentMatchers.anyString;
 
@@ -39,7 +43,13 @@ class FileUploadControllerTest {
 
     @Test
     void createDebtPositionsByFile_OK() throws IOException {
-        File file = File.createTempFile("test", ".zip");
+        // Creating a temporary file with a non-randomly generated name
+        File file = new File(System.getProperty("java.io.tmpdir"), "/test.zip");
+        // Warning: This will fail on Windows as it doesn't support PosixFilePermissions.
+        Files.createFile(
+                file.toPath(),
+                PosixFilePermissions.asFileAttribute(EnumSet.of(OWNER_READ, OWNER_WRITE)) // permissions `-rw-------`
+        );
 
         HttpRequest httpRequest = HttpRequest.create(HttpMethod.POST, URI)
                 .contentType(MediaType.MULTIPART_FORM_DATA)