Upstream/Plan
1
0
Fork 0
mirror of https://github.com/plan-player-analytics/Plan.git synced 2024-12-24 10:11:53 +01:00
Code Issues Projects Releases Wiki Activity

Fix customized resource lookup Path Traversal vulnerability

Browse Source 
Affects issues:
- Fixed #2830
This commit is contained in:
Aurora Lahtela 2023-01-13 23:23:12 +02:00
parent 205692af65
commit bd85f10c55
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
Plan/common/src/main/java/com/djrapitops/plan/storage/file/PlanFiles.java
View File

@ -156,6 +156,9 @@ public class PlanFiles implements SubSystem {
Path dir = config.get().getResourceSettings().getCustomizationDirectory();
if (dir.toFile().exists() && dir.toFile().isDirectory()) {
Path asPath = dir.resolve(resourceName);
if (!asPath.startsWith(dir)) {
return Optional.empty();
}
File found = asPath.toFile();
if (found.exists()) {
return Optional.of(found);