Commit 4ad149e1 authored by Phillip Webb's avatar Phillip Webb

Protect against bad paths and URLs

See gh-21722
parent 88e9f1d2
...@@ -53,11 +53,17 @@ public final class BuildpackReference { ...@@ -53,11 +53,17 @@ public final class BuildpackReference {
if (url.getProtocol().equals("file")) { if (url.getProtocol().equals("file")) {
return Paths.get(url.getPath()); return Paths.get(url.getPath());
} }
return null;
} }
catch (MalformedURLException ex) { catch (MalformedURLException ex) {
// not a URL, fall through to attempting to find a plain file path // not a URL, fall through to attempting to find a plain file path
} }
return Paths.get(this.value); try {
return Paths.get(this.value);
}
catch (Exception ex) {
return null;
}
} }
@Override @Override
......
...@@ -93,7 +93,7 @@ final class DirectoryBuildpack implements Buildpack { ...@@ -93,7 +93,7 @@ final class DirectoryBuildpack implements Buildpack {
*/ */
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) { static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
Path path = reference.asPath(); Path path = reference.asPath();
if (Files.exists(path) && Files.isDirectory(path)) { if (path != null && Files.exists(path) && Files.isDirectory(path)) {
return new DirectoryBuildpack(path); return new DirectoryBuildpack(path);
} }
return null; return null;
......
...@@ -109,7 +109,7 @@ final class TarGzipBuildpack implements Buildpack { ...@@ -109,7 +109,7 @@ final class TarGzipBuildpack implements Buildpack {
*/ */
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) { static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
Path path = reference.asPath(); Path path = reference.asPath();
if (Files.exists(path) && Files.isRegularFile(path)) { if (path != null && Files.exists(path) && Files.isRegularFile(path)) {
return new TarGzipBuildpack(path); return new TarGzipBuildpack(path);
} }
return null; return null;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment