opensource/cloudbeaver
3
0
Fork 0
mirror of https://github.com/dbeaver/cloudbeaver.git synced 2026-10-16 14:50:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

dbeaver/pro#9599 fix allows unauthorized server file stream (#4411)

Browse Source 
Co-authored-by: Daria Marutkina <125263541+dariamarutkina@users.noreply.github.com>
This commit is contained in:
Ruslan Musaev
2026-06-24 15:29:07 +02:00
committed by GitHub
co-authored by Daria Marutkina
parent 12030822ea
commit caef729a8d
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLProcessor.java
+15 -2
View File
@@ -1268,10 +1268,23 @@ public class WebSQLProcessor implements WebSessionProvider {
throws DBException {
if (cellRow instanceof Map<?, ?> variables) {
if (variables.get(FILE_ID) != null) {
Path path = WebAppUtils.getWebPlatform()
String fileId = variables.get(FILE_ID).toString();
try {
// file id must be UUID
UUID.fromString(fileId);
} catch (IllegalArgumentException e) {
throw new DBException("File ID is invalid");
}
Path uploadFolder = WebAppUtils.getWebPlatform()
.getTempFolder(webSession.getProgressMonitor(), TEMP_FILE_FOLDER)
.resolve(webSession.getSessionId())
.resolve(variables.get(FILE_ID).toString());
.normalize();
Path path = uploadFolder.resolve(fileId).normalize();
// ensure the resolved path stays within the session upload directory
if (!path.startsWith(uploadFolder)) {
throw new DBException("File ID is invalid");
}
try {
var file = Files.newInputStream(path);