Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Make calculation of session storage location more robust
  • Loading branch information
markt-asf committed Jan 12, 2022
1 parent 724a86e commit 1385c62
Show file tree
Hide file tree
Showing 2 changed files with 7 additions and 2 deletions.
5 changes: 3 additions & 2 deletions java/org/apache/catalina/session/FileStore.java
Expand Up @@ -349,13 +349,14 @@ private File file(String id) throws IOException {

String filename = id + FILE_EXT;
File file = new File(storageDir, filename);
File canonicalFile = file.getCanonicalFile();

// Check the file is within the storage directory
if (!file.getCanonicalFile().toPath().startsWith(storageDir.getCanonicalFile().toPath())) {
if (!canonicalFile.toPath().startsWith(storageDir.getCanonicalFile().toPath())) {
log.warn(sm.getString("fileStore.invalid", file.getPath(), id));
return null;
}

return file;
return canonicalFile;
}
}
4 changes: 4 additions & 0 deletions webapps/docs/changelog.xml
Expand Up @@ -118,6 +118,10 @@
<update>
Remove the deprecated <code>JmxRemoteLifecycleListener</code>. (markt)
</update>
<fix>
Make the calculation of the session storage location more robust when
using file based persistent storage. (markt)
</fix>
</changelog>
</subsection>
<subsection name="Coyote">
Expand Down

0 comments on commit 1385c62

Please sign in to comment.