This is an automated email from the ASF dual-hosted git repository. ggal pushed a commit to branch branch-0.9 in repository https://gitbox.apache.org/repos/asf/incubator-livy.git
commit fe49ab3223117b2a8e540224a800a781e36e4674 Author: Gyorgy Gal <[email protected]> AuthorDate: Mon Dec 1 14:59:49 2025 -0500 Update directory configuration --- server/src/main/scala/org/apache/livy/sessions/Session.scala | 4 +++- server/src/test/scala/org/apache/livy/sessions/SessionSpec.scala | 6 ++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/server/src/main/scala/org/apache/livy/sessions/Session.scala b/server/src/main/scala/org/apache/livy/sessions/Session.scala index 423f8ebb..d4bb491d 100644 --- a/server/src/main/scala/org/apache/livy/sessions/Session.scala +++ b/server/src/main/scala/org/apache/livy/sessions/Session.scala @@ -19,6 +19,7 @@ package org.apache.livy.sessions import java.io.InputStream import java.net.{URI, URISyntaxException} +import java.nio.file.Paths import java.security.PrivilegedExceptionAction import java.util.concurrent.{Executors, LinkedBlockingQueue, ThreadFactory, ThreadPoolExecutor, TimeUnit} import java.util.UUID @@ -134,7 +135,8 @@ object Session { if (resolved.getScheme() == "file") { // Make sure the location is whitelisted before allowing local files to be added. - require(livyConf.localFsWhitelist.find(resolved.getPath().startsWith).isDefined, + require(livyConf.localFsWhitelist.find( + Paths.get(resolved.getPath()).normalize.startsWith).isDefined, s"Local path ${uri.getPath()} cannot be added to user sessions.") } diff --git a/server/src/test/scala/org/apache/livy/sessions/SessionSpec.scala b/server/src/test/scala/org/apache/livy/sessions/SessionSpec.scala index aa5d4563..a7749634 100644 --- a/server/src/test/scala/org/apache/livy/sessions/SessionSpec.scala +++ b/server/src/test/scala/org/apache/livy/sessions/SessionSpec.scala @@ -51,6 +51,12 @@ class SessionSpec extends FunSuite with LivyBaseUnitTestSuite { Session.resolveURI(new URI(path), conf) } } + + Seq("/allowed/../file", "/also_allowed/../file").foreach { path => + intercept[IllegalArgumentException] { + Session.resolveURI(new URI(path), conf) + } + } } test("conf validation and preparation") {
