Fix for OS-13 - don't allow app pathnames to leave the app root
Change-Id: I6bb7be6df8be3dced903f72cef4600532cb118a3
diff --git a/core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java b/core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java
index 55c198e..339e68e 100644
--- a/core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java
+++ b/core/common/src/main/java/org/onosproject/common/app/ApplicationArchive.java
@@ -233,13 +233,17 @@
return new String(bytes, 0, Math.min(bytes.length, length), StandardCharsets.UTF_8);
}
+ private String filterAppNameForFilesystem(String name) {
+ return name.replace("/", "^");
+ }
+
/**
* Purges the application archive directory.
*
* @param appName application name
*/
public synchronized void purgeApplication(String appName) {
- File appDir = new File(appsDir, appName);
+ File appDir = new File(appsDir, filterAppNameForFilesystem(appName));
try {
Tools.removeDirectory(appDir);
} catch (IOException e) {
@@ -353,7 +357,7 @@
boolean isSelfContained = false;
ZipInputStream zis = new ZipInputStream(stream);
ZipEntry entry;
- File appDir = new File(appsDir, desc.name());
+ File appDir = new File(appsDir, filterAppNameForFilesystem(desc.name()));
while ((entry = zis.getNextEntry()) != null) {
if (!entry.isDirectory()) {
byte[] data = ByteStreams.toByteArray(zis);
@@ -437,7 +441,7 @@
private void saveApplication(InputStream stream, ApplicationDescription desc,
boolean isSelfContainedJar)
throws IOException {
- String name = desc.name() + (isSelfContainedJar ? JAR : OAR);
+ String name = filterAppNameForFilesystem(desc.name()) + (isSelfContainedJar ? JAR : OAR);
Files.write(toByteArray(stream), appFile(desc.name(), name));
}
@@ -499,7 +503,7 @@
// Returns the name of the file located under the specified app directory.
private File appFile(String appName, String fileName) {
- return new File(new File(appsDir, appName), fileName);
+ return new File(new File(appsDir, filterAppNameForFilesystem(appName)), fileName);
}
// Returns the icon file located under the specified app directory.