Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

False positive: Java: Uncontrolled data used in path expression #15686

Open
JLLeitschuh opened this issue Feb 21, 2024 · 1 comment
Open

False positive: Java: Uncontrolled data used in path expression #15686

JLLeitschuh opened this issue Feb 21, 2024 · 1 comment

Comments

@JLLeitschuh
Copy link
Contributor

Description of the false positive

This shouldn't be included because there is an adequate guard protecting against a path traversal payload.

Code samples or links to source code

    private Path indexRootPath(final String name) {
        final Path result = rootDir.resolve(name);
        if (result.startsWith(rootDir)) {
            return result;
        }
        throw new WebApplicationException(name + " attempts to escape from index root directory", Status.BAD_REQUEST);
    }

https://github.com/apache/couchdb/blob/43ab37ba6115851297de0804c563c1f0d23bf52a/nouveau/src/main/java/org/apache/couchdb/nouveau/core/IndexManager.java#L267-L273

URL to the alert on GitHub code scanning (optional)

https://github.com/Wolfi-Chainguard-Demo/apache__couchdb/security/code-scanning/6

@ginsbach
Copy link
Contributor

Thank you for filing this issue!
The FP should be removed by #12886, so release 2.16.3 should resolve it.

@sidshank sidshank added the Java label Feb 26, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants