Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Improvement] Abnormal characters check #15824

Merged
merged 8 commits into from
Apr 12, 2024
Merged

[Improvement] Abnormal characters check #15824

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
05afbb2
abnormal characters check
pinkfloyds Apr 10, 2024
3d29db7
Merge branch 'apache:dev' into dev
pinkfloyds Apr 10, 2024
e3206d6
add test case
pinkfloyds Apr 10, 2024
73e7cc7
remove error log
pinkfloyds Apr 10, 2024
d5b5aec
fix code style
pinkfloyds Apr 11, 2024
39cac57
Merge branch 'dev' into dev
pinkfloyds Apr 11, 2024
cbbac32
fix import
pinkfloyds Apr 11, 2024
0b6806d
Merge branch 'dev' into dev
pinkfloyds Apr 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions ...-api/src/main/java/org/apache/dolphinscheduler/api/service/impl/ResourcesServiceImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

package org.apache.dolphinscheduler.api.service.impl;

import static org.apache.dolphinscheduler.api.utils.CheckUtils.checkFilePath;
import static org.apache.dolphinscheduler.common.constants.Constants.ALIAS;
import static org.apache.dolphinscheduler.common.constants.Constants.CONTENT;
import static org.apache.dolphinscheduler.common.constants.Constants.EMPTY_STRING;
Expand Down Expand Up @@ -1290,6 +1291,10 @@ private void checkFullName(String userTenantCode, String fullName) {
if (FOLDER_SEPARATOR.equalsIgnoreCase(fullName)) {
return;
}
// abnormal characters check
if (!checkFilePath(fullName)) {
throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH);
}
// Avoid returning to the parent directory
if (fullName.contains("../")) {
throw new ServiceException(Status.ILLEGAL_RESOURCE_PATH, fullName);
Expand Down
10 changes: 10 additions & 0 deletions dolphinscheduler-api/src/main/java/org/apache/dolphinscheduler/api/utils/CheckUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,4 +158,14 @@ private static boolean regexChecks(String str, Pattern pattern) {

return pattern.matcher(str).matches();
}

/**
* regex FilePath check,only use a to z, A to Z, 0 to 9, and _./-
*
* @param str input string
* @return true if regex pattern is right, otherwise return false
*/
public static boolean checkFilePath(String str) {
return regexChecks(str, Constants.REGEX_FILE_PATH);
}
}
20 changes: 20 additions & 0 deletions dolphinscheduler-api/src/test/java/org/apache/dolphinscheduler/api/utils/CheckUtilsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,4 +92,24 @@ public void testCheckPhone() {
Assertions.assertTrue(CheckUtils.checkPhone("17362537263"));
}

/**
* check file path
*/
@Test
public void testCheckFilePath() {
// true
Assertions.assertTrue(CheckUtils.checkFilePath("/"));
Assertions.assertTrue(CheckUtils.checkFilePath("xx/"));
Assertions.assertTrue(CheckUtils.checkFilePath("/xx"));
Assertions.assertTrue(CheckUtils.checkFilePath("14567134578654"));
Assertions.assertTrue(CheckUtils.checkFilePath("/admin/root/"));
Assertions.assertTrue(CheckUtils.checkFilePath("/admin/root/1531531..13513/153135.."));
// false
Assertions.assertFalse(CheckUtils.checkFilePath(null));
Assertions.assertFalse(CheckUtils.checkFilePath("file://xxx/ss"));
Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss;/dasd/123"));
Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss && /dasd/123"));
Assertions.assertFalse(CheckUtils.checkFilePath("/xxx/ss || /dasd/123"));
}

}
5 changes: 5 additions & 0 deletions ...cheduler-common/src/main/java/org/apache/dolphinscheduler/common/constants/Constants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,6 +252,11 @@ private Constants() {
*/
public static final Pattern REGEX_USER_NAME = Pattern.compile("^[a-zA-Z0-9._-]{3,39}$");

/**
* file path regex
*/
public static final Pattern REGEX_FILE_PATH = Pattern.compile("^[a-zA-Z0-9_./-]+$");

/**
* read permission
*/
Expand Down
Loading