dxbjavid opened a new pull request, #3572: URL: https://github.com/apache/cxf/pull/3572
The filename on an inbound multipart part comes straight from the Content-Disposition header and is fully attacker controlled, and the RFC 5987 filename* form is percent-decoded here so that something like %2e%2e%2f turns back into ../ while still inside the parser. getFilename() then handed that value back untouched, so an application using the common new File(dir, cd.getFilename()) to save an upload could be walked outside its intended directory by a crafted part header. RFC 6266 section 4.3 says a recipient ought not to treat the value as a path, so this reduces the parsed filename to its final segment in the one place every caller reads it, the jaxrs ContentDisposition subclass included. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
