Compare canonical paths of Wsdl path and Archive path to avoid outsid…

…e hits
wso2 · Mar 19, 2024 · 14edd9d · 14edd9d
1 parent 88bb094
commit 14edd9d
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/...c/main/java/org/wso2/carbon/apimgt/rest/api/publisher/v1/common/mappings/ImportUtils.java b/...c/main/java/org/wso2/carbon/apimgt/rest/api/publisher/v1/common/mappings/ImportUtils.java
@@ -1631,7 +1631,13 @@ private static byte[] loadWsdlFile(String pathToArchive, APIDTO apiDto) throws I
         }
 
         if (!StringUtils.isEmpty(pathToWsdl)) {
-            return FileUtils.readFileToByteArray(new File(pathToWsdl));
+            // Check the Canonical paths
+            File file = new File(pathToWsdl);
+            String canonicalPath = file.getCanonicalPath();
+            if (!canonicalPath.startsWith(new File(pathToArchive).getCanonicalPath())) {
+                throw new IOException("Attempt to upload invalid zip archive. File path is outside target directory");
+            }
+            return FileUtils.readFileToByteArray(file);
         }
         throw new IOException("Missing WSDL file. It should be present.");
     }