Уязвимости функциональности работы с файлами

package com.company.sample.fs;

import io.jmix.core.FileRef;
import io.jmix.core.FileStorageException;
import io.jmix.localfs.LocalFileStorage;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Primary;
import org.springframework.stereotype.Component;

import java.io.IOException;
import java.io.InputStream;
import java.nio.file.Files;
import java.nio.file.Path;

@Primary
@Component
public class FixedLocalFileStorage extends LocalFileStorage {

    private static final Logger log = LoggerFactory.getLogger(FixedLocalFileStorage.class);

    @Override
    public InputStream openStream(FileRef reference) {
        Path relativePath = getRelativePath(reference.getPath());

        Path[] roots = getStorageRoots();
        if (roots.length == 0) {
            log.error("No storage directories available");
            throw new FileStorageException(FileStorageException.Type.FILE_NOT_FOUND, reference.toString());
        }

        InputStream inputStream = null;
        for (Path root : roots) {
            Path path = root.resolve(relativePath);
            if (!path.toFile().exists()) {
                log.error("File " + path + " not found");
                continue;
            }
            try {
                if (!path.toRealPath().startsWith(root.toRealPath())) {
                    log.error("File '{}' is outside of root dir '{}': ", path, root);
                    continue;
                }
                inputStream = Files.newInputStream(path);
            } catch (IOException e) {
                log.error("Error opening input stream for " + path, e);
            }
        }
        if (inputStream != null) {
            return inputStream;
        } else {
            throw new FileStorageException(FileStorageException.Type.FILE_NOT_FOUND, reference.toString());
        }
    }
}

javaCopied!

jmix.core.exclude-beans=locfs_FileStorage

propertiesCopied!

package com.company.sample.security;

import jakarta.servlet.FilterChain;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

public class BlockingFilter extends OncePerRequestFilter {

    private static final Logger log = LoggerFactory.getLogger(BlockingFilter.class);

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException {
        String requestURI = request.getRequestURI();
        log.debug("Block request to '{}'", requestURI);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.getWriter().write("This endpoint is disabled.");
    }
}

javaCopied!

@Bean
public FilterRegistrationBean<BlockingFilter> restFilesBlockingFilter() {
    FilterRegistrationBean<BlockingFilter> registrationBean = new FilterRegistrationBean<>();
    registrationBean.setFilter(new BlockingFilter());
    registrationBean.addUrlPatterns("/rest/files");
    registrationBean.setOrder(1);
    return registrationBean;
}

javaCopied!

package com.company.sample.web;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.FilterChain;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class BlockingFilter extends OncePerRequestFilter {

    private static final Logger log = LoggerFactory.getLogger(BlockingFilter.class);

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException {
        String requestURI = request.getRequestURI();
        log.debug("Block request to '{}'", requestURI);
        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        response.getWriter().write("This endpoint is disabled.");
    }
}

javaCopied!

<filter>
    <filter-name>cuba_blocking_filter</filter-name>
    <filter-class>com.company.sample.web.BlockingFilter</filter-class>
    <async-supported>true</async-supported>
</filter>
<filter-mapping>
    <filter-name>cuba_blocking_filter</filter-name>
    <url-pattern>/rest/v2/files/*</url-pattern>
</filter-mapping>

xmlCopied!

<filter-mapping>
    <filter-name>cuba_blocking_filter</filter-name>
    <url-pattern>/dispatch/api/upload</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>cuba_blocking_filter</filter-name>
    <url-pattern>/dispatch/api/download</url-pattern>
</filter-mapping>

xmlCopied!