CVE-2022-29253: XWIKI-19349: Bad handling of classloader templates path resolution · xwiki/xwiki-platform@4917c8f

@@ -24,6 +24,8 @@

import java.lang.reflect.Type;

import java.net.URL;

import java.nio.charset.StandardCharsets;

import java.nio.file.Path;

import java.nio.file.Paths;

import java.util.AbstractSet;

import java.util.Arrays;

import java.util.Collections;

@@ -896,14 +898,23 @@ private EnvironmentTemplate getFileSystemTemplate(String templateName)

: null;

}

private Template getClassloaderTemplate(String suffixPath, String templateName)

private Template getClassloaderTemplate(String prefixPath, String templateName)

{

return getClassloaderTemplate(Thread.currentThread().getContextClassLoader(), suffixPath, templateName);

return getClassloaderTemplate(Thread.currentThread().getContextClassLoader(), prefixPath, templateName);

}

private Template getClassloaderTemplate(ClassLoader classloader, String suffixPath, String templateName)

private Template getClassloaderTemplate(ClassLoader classloader, String prefixPath, String templateName)

{

String templatePath = suffixPath + templateName;

String templatePath = prefixPath + templateName;

// Prevent access to resources from other directories

Path normalizedResource = Paths.get(templatePath).normalize();

// Protect against directory attacks.

if (!normalizedResource.startsWith(prefixPath)) {

this.logger.warn("Direct access to skin file [{}] refused. Possible break-in attempt!", normalizedResource);

return null;

}

URL url = classloader.getResource(templatePath);