From caef729a8d227b0446eab6f0ae5f1dc20dced9b5 Mon Sep 17 00:00:00 2001 From: Ruslan Musaev <43766501+HocKu7@users.noreply.github.com> Date: Wed, 24 Jun 2026 15:29:07 +0200 Subject: [PATCH] dbeaver/pro#9599 fix allows unauthorized server file stream (#4411) Co-authored-by: Daria Marutkina <125263541+dariamarutkina@users.noreply.github.com> --- .../service/sql/WebSQLProcessor.java | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLProcessor.java b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLProcessor.java index e875b477da..f18770d4ca 100644 --- a/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLProcessor.java +++ b/server/bundles/io.cloudbeaver.server/src/io/cloudbeaver/service/sql/WebSQLProcessor.java @@ -1268,10 +1268,23 @@ public class WebSQLProcessor implements WebSessionProvider { throws DBException { if (cellRow instanceof Map variables) { if (variables.get(FILE_ID) != null) { - Path path = WebAppUtils.getWebPlatform() + String fileId = variables.get(FILE_ID).toString(); + try { + // file id must be UUID + UUID.fromString(fileId); + } catch (IllegalArgumentException e) { + throw new DBException("File ID is invalid"); + } + + Path uploadFolder = WebAppUtils.getWebPlatform() .getTempFolder(webSession.getProgressMonitor(), TEMP_FILE_FOLDER) .resolve(webSession.getSessionId()) - .resolve(variables.get(FILE_ID).toString()); + .normalize(); + Path path = uploadFolder.resolve(fileId).normalize(); + // ensure the resolved path stays within the session upload directory + if (!path.startsWith(uploadFolder)) { + throw new DBException("File ID is invalid"); + } try { var file = Files.newInputStream(path);