mirror of
https://github.com/spring-projects/spring-boot.git
synced 2024-08-29 03:06:45 +08:00
Protect against bad paths and URLs
See gh-21722
This commit is contained in:
parent
88e9f1d28c
commit
4ad149e1e7
@ -53,11 +53,17 @@ public final class BuildpackReference {
|
||||
if (url.getProtocol().equals("file")) {
|
||||
return Paths.get(url.getPath());
|
||||
}
|
||||
return null;
|
||||
}
|
||||
catch (MalformedURLException ex) {
|
||||
// not a URL, fall through to attempting to find a plain file path
|
||||
}
|
||||
return Paths.get(this.value);
|
||||
try {
|
||||
return Paths.get(this.value);
|
||||
}
|
||||
catch (Exception ex) {
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
||||
@Override
|
||||
|
@ -93,7 +93,7 @@ final class DirectoryBuildpack implements Buildpack {
|
||||
*/
|
||||
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
|
||||
Path path = reference.asPath();
|
||||
if (Files.exists(path) && Files.isDirectory(path)) {
|
||||
if (path != null && Files.exists(path) && Files.isDirectory(path)) {
|
||||
return new DirectoryBuildpack(path);
|
||||
}
|
||||
return null;
|
||||
|
@ -109,7 +109,7 @@ final class TarGzipBuildpack implements Buildpack {
|
||||
*/
|
||||
static Buildpack resolve(BuildpackResolverContext context, BuildpackReference reference) {
|
||||
Path path = reference.asPath();
|
||||
if (Files.exists(path) && Files.isRegularFile(path)) {
|
||||
if (path != null && Files.exists(path) && Files.isRegularFile(path)) {
|
||||
return new TarGzipBuildpack(path);
|
||||
}
|
||||
return null;
|
||||
|
Loading…
Reference in New Issue
Block a user