Describe the bug
The normalize method doesn't check for a closing bracket when checking if a path segment is a symbol.
This causes the processing of ".." segments to fail, and not collapse. after these broken symbol segments.
Steps to Reproduce
Pass a path that contains a symbol with only an opening bracket and "/root/${/../rest_of_path"
Expected behavior
Expect above string to resolve to "/root/rest_of_path"
Diagnostic information:
- OpenLiberty Version: < 26.0.0.7
- Affected feature(s) restConnector-2.0
- Java Version: [i.e. full output of
java -version]
- server.xml configuration (WITHOUT sensitive information like passwords)
- If it would be useful, upload the messages.log file found in
$WLP_OUTPUT_DIR/messages.log
Additional context
The FileTransfer writeDir/readDir through the restConnector feature can escape the designated paths
Describe the bug
The normalize method doesn't check for a closing bracket when checking if a path segment is a symbol.
This causes the processing of ".." segments to fail, and not collapse. after these broken symbol segments.
Steps to Reproduce
Pass a path that contains a symbol with only an opening bracket and "/root/${/../rest_of_path"
Expected behavior
Expect above string to resolve to "/root/rest_of_path"
Diagnostic information:
java -version]$WLP_OUTPUT_DIR/messages.logAdditional context
The FileTransfer writeDir/readDir through the restConnector feature can escape the designated paths