[FELIX-6271] Make sure invalid bundles are deleted in BundleServlet

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: webconsole-4.5.0
• Fix Version/s: webconsole-4.5.2
• Component/s: Web Console
• Assignee: Carsten Ziegeler
• Reporter: Colm O hEigeartaigh
• Created: 30/Apr/20 10:11
• Updated: 08/May/20 06:31
• Resolved: 30/Apr/20 10:29

Description

If you attempt to upload an invalid bundle in BundleServlet (say a regular war file), null is returned from getSymbolicNameVersion(bundleFile). This result in a NPE and the bundleFile is not actually deleted. This could potentially allow someone to fill up the disk space of the server by repeatedly uploading large invalid war/jars.

 

PR: https://github.com/apache/felix-dev/pull/20

 

Issue Links

• links to: GitHub Pull Request #20