Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 320546

Summary: FileLocator.find() can find files outside of the bundle
Product: [Eclipse Project] Equinox Reporter: Chris Goldthorpe <cgold>
Component: FrameworkAssignee: Thomas Watson <tjwatson>
Status: RESOLVED FIXED QA Contact:
Severity: normal    
Priority: P3 CC: kaloyan, Mike_Wilson, pwebster, tjwatson, yxzhong
Version: 3.6   
Target Milestone: 3.7 M1   
Hardware: PC   
OS: Windows XP   
Whiteboard:
Attachments:
Description Flags
Test case
none
patch + test none

Description Chris Goldthorpe CLA 2010-07-21 15:23:46 EDT 
This was discovered while investigating Bug 223539.

If a bundle is not jarred the line below

URL url = FileLocator.find(bundle, new Path("../file.txt"), null);	

can be used to access a file outside of the bundle, and any file on the system could potentially be accessed this way. There does not seem to be any reason to allow this as only bad things can happen if the FileLocator is used to read files outside the bundle.
Comment 1 Chris Goldthorpe CLA 2010-07-21 15:28:57 EDT 
Created attachment 174902 [details]
Test case

To reproduce:

Unzip the attachment in a temporary directory.
Create a text file file.txt in the directory which contains the bundle.
File/Import/Existing Project 
Launch Eclipse

File Locate Menu/File Locate Test

A messagebox opens showing the contents of file.txt, which was located using FileLocator.find()
Comment 2 Thomas Watson CLA 2010-07-22 14:25:47 EDT 
It turns out that Bundle.getEntry can leak out URLs that point to resources are outside of a directory bundle's top level directory.  I will look at fixing this.
Comment 3 Thomas Watson CLA 2010-07-22 16:33:47 EDT 
Created attachment 175023 [details]
patch + test

There were four methods on DirBundleFile that allowed you to access or get information on files outside of the directory bundle file itself.  This patch does some extra checks if folks are trying ".." paths to access bundle content from a directory bundle.

I was tempted to always fail to find resources if the path contained any ".."s since this is not supported for jar'ed bundles.  But this patch is a more conservative behavior change.  It only fails to find files if they end up being outside of the bundle's content.
Comment 4 Thomas Watson CLA 2010-07-22 16:36:38 EDT 
patch released.
Comment 5 Thomas Watson CLA 2013-09-30 09:01:18 EDT 
*** Bug 418266 has been marked as a duplicate of this bug. ***