test(storage): add explicit test coverage for GHSA-h7c7-3mfc-m7pj forward-slash path traversal#16593
Open
AcevedoR wants to merge 1 commit into
Open
test(storage): add explicit test coverage for GHSA-h7c7-3mfc-m7pj forward-slash path traversal#16593AcevedoR wants to merge 1 commit into
AcevedoR wants to merge 1 commit into
Conversation
Contributor
🐋 Docker imagedocker run --pull=always --rm -it -p 8080:8080 --user=root -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp ghcr.io/kestra-io/kestra-pr:16593 server local🧪 Java Unit Tests
|
Contributor
Tests report quick summary:success ✅ > tests: 6824, success: 6804, skipped: 20, failed: 0 (🔄 6824 executed, 📦 0 from cache) unfold for details
Develocity build scan: https://develocity.kestra.io/s/6gnmcw6wc6ygy Flaky tests report quick summary:failed ❌ > tests: 14, success: 13, skipped: 0, failed: 1
Failed tests:webserver > io.kestra.webserver.controllers.api.MiscControllerTest > canTriggerAWebhookWithoutBasicAuth() failed ❌ in 30.500 |
…ward-slash path traversal
Adds dedicated test cases for the Windows-specific path traversal reported in
GHSA-h7c7-3mfc-m7pj, where the old guard used File.separator ('\\' on Windows)
and never matched forward-slash HTTP URI payloads like /x/../../../foo.txt.
The fix was shipped as part of GHSA-qw4v-6w32-xx9h (commit b41d0ce) but had
no test cases explicitly covering the forward-slash / Windows-JVM attack surface.
- FileUtilsTest: add forward-slash traversal cases to both URI and String
parameterized tests, labeled GHSA-h7c7-3mfc-m7pj
- NamespaceFileTest: add shouldThrowOnForwardSlashPathTraversal() asserting that
NamespaceFile.normalize() rejects /x/../../../ payloads (the toLogicalPath() +
FileUtils.isParentTraversal() chain must work regardless of host OS)
- NamespaceFileControllerTest: add shouldRejectForwardSlashPathTraversalOnWriteAndDelete()
exercising the POST (write) and DELETE primitives end-to-end via the HTTP layer
AcevedoR
force-pushed
the
fix/GHSA-h7c7-3mfc-m7pj-path-traversal-tests
branch
from
014c661 to
77cacee
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
File.separator(\on Windows) was used in the guard, causing forward-slash HTTP URI payloads like/x/../../../foo.txtto bypass it entirelyb41d0ceeebas part of GHSA-qw4v-6w32-xx9h, but carried no test cases for this specific forward-slash / Windows-JVM attack surfaceWhat changed
FileUtilsTest— adds forward-slash traversal cases (/x/../../../escaped.txt, etc.) to both theURIandStringparameterized tests, labeledGHSA-h7c7-3mfc-m7pjNamespaceFileTest— addsshouldThrowOnForwardSlashPathTraversal()asserting thatNamespaceFile.normalize()rejects these payloads; thetoLogicalPath()+FileUtils.isParentTraversal()chain normalizes\→/regardless of host OS, so forward-slash/../segments are always caughtNamespaceFileControllerTest— addsshouldRejectForwardSlashPathTraversalOnWriteAndDelete()exercising the two primitives the advisory demonstrated end-to-end:POST .../files?path=/x/../../../escaped.txt(write) andDELETE .../files?path=/x/../../../safe.txt(delete), both over HTTPTest plan
FileUtilsTest— 29 tests, 0 failuresNamespaceFileTest— 17 tests, 0 failuresNamespaceFileControllerTest#shouldRejectForwardSlashPathTraversalOnWriteAndDelete— passes