Merge pull request #1728 from msm1992/master

Fix issues in SynapseArtifactUploaderAdmin service
wso2 · Jul 30, 2024 · d1ab171 · d1ab171
2 parents 996fee3 + d51380d
commit d1ab171
Show file tree

Hide file tree

Showing 2 changed files with 48 additions and 0 deletions.
diff --git a/...rc/main/java/org/wso2/carbon/mediation/artifactuploader/SynapseArtifactUploaderAdmin.java b/...rc/main/java/org/wso2/carbon/mediation/artifactuploader/SynapseArtifactUploaderAdmin.java
@@ -20,14 +20,25 @@
 public class SynapseArtifactUploaderAdmin extends AbstractAdmin {
 
     private static final Log log = LogFactory.getLog(SynapseArtifactUploaderAdmin.class);
+    private static final String XML_EXTENSION = "xml";
 
     public boolean uploadArtifact(String fileName, DataHandler dataHandler) throws AxisFault {
 
         File artifactDir = new File(getExtensionRepoPath());
         File tempDir = new File(CarbonUtils.getCarbonHome() + File.separator + "tmp");
         File destinationTempFile = new File(tempDir, fileName);
         FileOutputStream fos = null;
+
+        String fileExtension = SynapseArtifactUploaderUtil.getFileExtension(fileName);
+        if (!XML_EXTENSION.equals(fileExtension)) {
+            throw new AxisFault("Invalid file type: " + fileExtension);
+        }
+
         try {
+            if (!SynapseArtifactUploaderUtil.validateFilePath(destinationTempFile, tempDir)) {
+                throw new AxisFault("Attempt to upload " + destinationTempFile + ". File path is " +
+                        "outside target directory");
+            }
             fos = FileUtils.openOutputStream(destinationTempFile);
             dataHandler.writeTo(fos);
         } catch (IOException e) {
@@ -56,6 +67,17 @@ public String[] getArtifacts() {
     }
 
     public boolean removeArtifact(String fileName) throws AxisFault {
+        File destinationFile = new File(getExtensionRepoPath() + File.separator + fileName);
+        File artifactDir = new File(getExtensionRepoPath());
+        try {
+            if (!SynapseArtifactUploaderUtil.validateFilePath(destinationFile, artifactDir)) {
+                throw new AxisFault("Attempt to delete " + destinationFile + ". File path is " +
+                        "outside target directory");
+            }
+        } catch (IOException e) {
+            handleException("File Delete failed", e);
+        }
+
         File artifactFile = new File(getExtensionRepoPath() + File.separator + fileName);
 
         if (artifactFile.exists() && artifactFile.isFile()) {

diff --git a/...ain/java/org/wso2/carbon/mediation/artifactuploader/util/SynapseArtifactUploaderUtil.java b/...ain/java/org/wso2/carbon/mediation/artifactuploader/util/SynapseArtifactUploaderUtil.java
@@ -1,6 +1,7 @@
 package org.wso2.carbon.mediation.artifactuploader.util;
 
 import java.io.File;
+import java.io.IOException;
 import java.util.ArrayList;
 
 /**
@@ -31,4 +32,29 @@ public static String[] getArtifacts(String extensionsPath) {
         return artifactList;
     }
 
+    /**
+     * Finds the extension of a given file
+     *
+     * @param fileName - name of the file
+     * @return - extension
+     */
+    public static String getFileExtension(String fileName) {
+        int index = fileName.lastIndexOf('.');
+        return fileName.substring(index + 1);
+    }
+
+    /**
+     * Validates whether the destinationFile is copied to the target directory
+     *
+     * @param destinationFile - file to be uploaded or removed
+     * @param targetDirectory - target directory
+     * @return true if the destination file is copied to the target directory
+     * @throws IOException
+     */
+    public static boolean validateFilePath(File destinationFile, File targetDirectory) throws IOException {
+        String canonicalPathToFile = destinationFile.getCanonicalPath();
+        String canonicalPathToArtifactDir = targetDirectory.getCanonicalPath();
+        return canonicalPathToFile.startsWith(canonicalPathToArtifactDir);
+    }
+
 }