From f6812f151878c48fc62fb0f40b8926de5a93a7bd Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:04:19 +0000
Subject: [PATCH] Fix java/zipslip CodeQL alerts by validating archive entry paths (#761)
---
opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java | 25 ++++++++++++++++++-------
1 files changed, 18 insertions(+), 7 deletions(-)
diff --git a/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java b/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
index ece9fa2..6ab98dc 100644
--- a/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
+++ b/opendj-maven-plugin/src/main/java/org/forgerock/opendj/maven/GenerateConfigMojo.java
@@ -25,6 +25,7 @@
import java.io.IOException;
import java.net.JarURLConnection;
import java.net.URL;
+import java.nio.file.Path;
import java.util.Enumeration;
import java.util.LinkedHashMap;
import java.util.LinkedList;
@@ -245,6 +246,16 @@
createTransformTask(inputFactory, output, stylesheet, executor, parameters);
}
+ /** Resolves a file name against an output directory, refusing names which escape it. */
+ private static String safeOutputPath(final String outputDir, final String fileName) throws IOException {
+ final Path outputDirPath = new File(outputDir).toPath().toAbsolutePath().normalize();
+ final Path outputFile = outputDirPath.resolve(fileName).normalize();
+ if (!outputFile.startsWith(outputDirPath)) {
+ throw new IOException("File name '" + fileName + "' is outside of the output directory");
+ }
+ return outputFile.toString();
+ }
+
private void executeTransformXMLDefinitions() throws Exception {
getLog().info("Transforming XML definitions...");
@@ -282,24 +293,24 @@
for (final Map.Entry<String, StreamSourceFactory> entry : componentDescriptors
.entrySet()) {
- final String meta = metaDir + entry.getKey() + "CfgDefn.java";
+ final String meta = safeOutputPath(metaDir, entry.getKey() + "CfgDefn.java");
createTransformTask(entry.getValue(), meta, stylesheetMetaJava, parallelExecutor);
- final String server = serverDir + entry.getKey() + "Cfg.java";
+ final String server = safeOutputPath(serverDir, entry.getKey() + "Cfg.java");
createTransformTask(entry.getValue(), server, stylesheetServerJava,
parallelExecutor);
- final String client = clientDir + entry.getKey() + "CfgClient.java";
+ final String client = safeOutputPath(clientDir, entry.getKey() + "CfgClient.java");
createTransformTask(entry.getValue(), client, stylesheetClientJava,
parallelExecutor);
- final String ldap = ldapProfileDir + entry.getKey() + "CfgDefn.properties";
+ final String ldap = safeOutputPath(ldapProfileDir, entry.getKey() + "CfgDefn.properties");
createTransformTask(entry.getValue(), ldap, stylesheetProfileLDAP, parallelExecutor);
- final String cli = cliProfileDir + entry.getKey() + "CfgDefn.properties";
+ final String cli = safeOutputPath(cliProfileDir, entry.getKey() + "CfgDefn.properties");
createTransformTask(entry.getValue(), cli, stylesheetProfileCLI, parallelExecutor);
- final String i18n = i18nDir + entry.getKey() + "CfgDefn.properties";
+ final String i18n = safeOutputPath(i18nDir, entry.getKey() + "CfgDefn.properties");
createTransformTask(entry.getValue(), i18n, stylesheetMessages, parallelExecutor);
createTransformTask(entry.getValue(), manifest, stylesheetManifest,
@@ -324,7 +335,7 @@
}
}
};
- final String profile = javaDir + "/" + entry.getKey() + "/package-info.java";
+ final String profile = safeOutputPath(javaDir, entry.getKey() + "/package-info.java");
createTransformTask(sourceFactory, profile, entry.getValue(), parallelExecutor,
"type", entry.getKey());
}
--
Gitblit v1.10.0