janhoy commented on a change in pull request #1572:
URL: https://github.com/apache/lucene-solr/pull/1572#discussion_r439772292
##########
File path: solr/core/src/java/org/apache/solr/core/SolrPaths.java
##########
@@ -128,4 +130,33 @@ private static void logOnceInfo(String key, String msg) {
log.info(msg);
}
}
+
+ /**
+ * Checks that the given path is relative to SOLR_HOME, SOLR_DATA_HOME,
coreRootDirectory or one of the paths
+ * specified in solr.xml's allowPaths element. The following paths will fail
validation
+ * <ul>
+ * <li>Relative paths starting with <code>..</code></li>
+ * <li>Windows UNC paths (<code>\\host\share\path</code>)</li>
+ * <li>Absolute paths which are not below the list of allowed paths</li>
+ * </ul>
+ * @param pathToAssert path to check
+ * @param allowPaths list of paths that should be allowed prefixes
+ * @throws SolrException if path is outside allowed paths
+ */
+ public static void assertPathAllowed(Path pathToAssert, Set<Path>
allowPaths) throws SolrException {
+ if (OS.isFamilyWindows() && pathToAssert.toString().startsWith("\\\\")) {
Review comment:
I have not tested this on Windows. On my mac, the `Path` class uses an
OSX implementation so I think it will not detect the UNC style path, it does
not manage to normalize or make it absolute, so I scoped the check for Windows
only. I test on the string version before normalizing since normalize may mess
up UNC paths.
I decided to block UNC totally instead of trying to be smart about it. Users
can always map a drive letter to the desired share to work around it?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@lucene.apache.org
For additional commands, e-mail: issues-h...@lucene.apache.org
