Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Protect against bad paths and URLs

Browse Source 
See gh-21722
This commit is contained in:
Phillip Webb
2021-02-18 16:22:56 -08:00
parent 88e9f1d28c
commit 4ad149e1e7
3 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/build/BuildpackReference.java
View File

@@ -53,11 +53,17 @@ public final class BuildpackReference {
if (url.getProtocol().equals("file")) {
return Paths.get(url.getPath());
}
return null;
}
catch (MalformedURLException ex) {
// not a URL, fall through to attempting to find a plain file path
}
return Paths.get(this.value);
try {
return Paths.get(this.value);
}
catch (Exception ex) {
return null;
}
}
@Override

2
spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/build/DirectoryBuildpack.java
View File

@@ -93,7 +93,7 @@ final class DirectoryBuildpack implements Buildpack {
*/
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
Path path = reference.asPath();
if (Files.exists(path) && Files.isDirectory(path)) {
if (path != null && Files.exists(path) && Files.isDirectory(path)) {
return new DirectoryBuildpack(path);
}
return null;

2
spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/main/java/org/springframework/boot/buildpack/platform/build/TarGzipBuildpack.java
View File

@@ -109,7 +109,7 @@ final class TarGzipBuildpack implements Buildpack {
*/
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
Path path = reference.asPath();
if (Files.exists(path) && Files.isRegularFile(path)) {
if (path != null && Files.exists(path) && Files.isRegularFile(path)) {
return new TarGzipBuildpack(path);
}
return null;