Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Protect against symlink attacks

Browse Source 
Update embedded launch script to no longer change ownership of files
or folders that already exist.

Fixes gh-11397
This commit is contained in:
Phillip Webb
2018-01-10 14:24:40 -08:00
parent 604ec075eb
commit 9b8cb9a463
5 changed files with 78 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-tools/spring-boot-loader-tools/src/main/resources/org/springframework/boot/loader/tools/launch.script
View File

@@ -146,12 +146,12 @@ start() {
do_start() {
working_dir=$(dirname "$jarfile")
pushd "$working_dir" > /dev/null
mkdir -p "$PID_FOLDER" &> /dev/null
if [[ ! -e "$PID_FOLDER" ]]; then
mkdir -p "$PID_FOLDER" &> /dev/null
chown "$run_user" "$PID_FOLDER"
fi
if [[ -n "$run_user" ]]; then
checkPermissions || return $?
chown "$run_user" "$PID_FOLDER"
chown "$run_user" "$pid_file"
chown "$run_user" "$log_file"
if [ $USE_START_STOP_DAEMON = true ] && type start-stop-daemon > /dev/null 2>&1; then
start-stop-daemon --start --quiet \
--chuid "$run_user" \