[SOLR-15169] SolrPaths.assertPathAllowed normalization problem

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 9.0
• Assignee: Jan Høydahl
• Reporter: Andras Salamon
• Created: 19/Feb/21 12:41
• Updated: 12/May/22 00:26
• Resolved: 11/Apr/21 16:23

Description

In the SolrPaths.assertPathAllowed the normalize() method is only called for pathToAssert and not for the allowPaths elements, which means that the following call gives SolrException:

SolrPaths.assertPathAllowed(Path.of("/a/b/../b/d"), Set.of(Path.of("/a/b/../b"), Path.of("/c"))); 

even if "a/b/..b/" is a prefix of "/a/b/../b/d".

Issue Links

• links to: GitHub Pull Request #22
• links to: GitHub Pull Request #2406