Reamer commented on a change in pull request #4282:
URL: https://github.com/apache/zeppelin/pull/4282#discussion_r790507833
##########
File path:
zeppelin-zengine/src/main/java/org/apache/zeppelin/interpreter/InterpreterSettingManager.java
##########
@@ -1035,6 +1035,9 @@ private boolean inlineRemove(String id, boolean
initiator) throws IOException {
}
File localRepoDir = new File(conf.getInterpreterLocalRepoPath() + "/" +
id);
+ if (localRepoDir.getAbsolutePath().contains("..")) {
+ return removed;
+ }
FileUtils.deleteDirectory(localRepoDir);
Review comment:
At first I would try to move the deletion to the if block. After that, a
path check should be unnecessary.
If this solution doesn't work I would prefer such code.
```java
File localRepoPath = new File(conf.getInterpreterLocalRepoPath())
if (Arrays.stream(localRepoPath.list()).anyMatch(id::equals)) {
FileUtils.deleteDirectory(new File(localRepoPath, id));
}
```
`..` is not a good solution, as this does not protect against attacks that
delete files inside the `localRepoDir`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscr...@zeppelin.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
