diff --git a/src/main/java/io/whitesource/cure/FileSecurityUtils.java b/src/main/java/io/whitesource/cure/FileSecurityUtils.java index 3921104..8275f64 100644 --- a/src/main/java/io/whitesource/cure/FileSecurityUtils.java +++ b/src/main/java/io/whitesource/cure/FileSecurityUtils.java @@ -22,14 +22,7 @@ public static boolean isFileOutsideDir( @NonNull final String filePath, @NonNull final String baseDirPath) throws IOException { File file = new File(filePath); File baseDir = new File(baseDirPath); - return !file.getCanonicalPath().startsWith(addTrailingSeparator(baseDir.getCanonicalPath())); - } - - private static String addTrailingSeparator(String path) { - if (!path.endsWith(File.separator)) { - return path + File.separator; - } - return path; + return !file.getCanonicalFile().toPath().startsWith(baseDir.getCanonicalFile().toPath()); } /** diff --git a/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java b/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java index 5ec5703..be28742 100644 --- a/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java +++ b/src/test/java/io/whitesource/cure/FileSecurityUtilsTests.java @@ -50,6 +50,13 @@ void normalize_validInput_successfullyWithResult() { Assertions.assertEquals(expectedResult, actualResult); } + @Test + void isFileOutsideDirStartsWithTest() throws IOException { + String taintedInput = "/usr/foo/../foo-bar/bar"; + String baseDir = "/usr/foo"; + Assertions.assertTrue(FileSecurityUtils.isFileOutsideDir(taintedInput, baseDir)); + } + @Test void normalize_null_successfully() { Assertions.assertNull(FileSecurityUtils.normalize(null));