Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Protect against symlink attacks

Browse Source 
Update embedded launch script to no longer change ownership of files
or folders that already exist.

Fixes gh-11397
This commit is contained in:
Phillip Webb
2018-01-10 14:24:40 -08:00
parent 604ec075eb
commit 9b8cb9a463
5 changed files with 78 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
spring-boot-integration-tests/spring-boot-launch-script-tests/src/test/java/org/springframework/boot/launchscript/SysVinitLaunchScriptIT.java
View File

@@ -220,6 +220,25 @@ public class SysVinitLaunchScriptIT {
coloredString(AnsiColor.GREEN, "Stopped [" + extractPid(output) + "]"));
}
@Test
public void pidFolderOwnership() throws Exception {
String output = doTest("pid-folder-ownership.sh");
System.err.println(output);
assertThat(output).contains("phil root");
}
@Test
public void pidFileOwnership() throws Exception {
String output = doTest("pid-file-ownership.sh");
assertThat(output).contains("phil root");
}
@Test
public void logFileOwnership() throws Exception {
String output = doTest("log-file-ownership.sh");
assertThat(output).contains("phil root");
}
@Test
public void launchWithRelativeLogFolder() throws Exception {
String output = doTest("launch-with-relative-log-folder.sh");

20
spring-boot-integration-tests/spring-boot-launch-script-tests/src/test/resources/scripts/log-file-ownership.sh Executable file
View File

@@ -0,0 +1,20 @@
source ./test-functions.sh
install_service
chmod o+w /var/log
useradd phil
mkdir /phil-files
chown phil /phil-files
useradd andy
chown andy /test-service/spring-boot-app.jar
start_service
stop_service
su - andy -c "ln -s -f /phil-files /var/log/spring-boot-app.log"
start_service
ls -ld /phil-files

18
spring-boot-integration-tests/spring-boot-launch-script-tests/src/test/resources/scripts/pid-file-ownership.sh Executable file
View File

@@ -0,0 +1,18 @@
source ./test-functions.sh
install_service
useradd phil
mkdir /phil-files
chown phil /phil-files
useradd andy
chown andy /test-service/spring-boot-app.jar
start_service
stop_service
su - andy -c "ln -s /phil-files /var/run/spring-boot-app/spring-boot-app.pid"
start_service
ls -ld /phil-files

17
spring-boot-integration-tests/spring-boot-launch-script-tests/src/test/resources/scripts/pid-folder-ownership.sh Executable file
View File

@@ -0,0 +1,17 @@
source ./test-functions.sh
install_service
chmod o+w /var/run
useradd phil
mkdir /phil-files
chown phil /phil-files
useradd andy
chown andy /test-service/spring-boot-app.jar
su - andy -c "ln -s -f /phil-files /var/run/spring-boot-app"
start_service
ls -ld /phil-files