Fix security vulnerability in Path recursive functions #KT-63103

* Prohibit files with name "." or ".."
* Detect cycles caused by files with name "/"
* Prohibit copy outside the target directory

The commit also moves zip-related tests to PathRecursiveFunctionsZipTest.
This commit is contained in:
Abduqodiri Qurbonzoda
2023-11-06 16:18:37 +02:00
committed by Space Team
parent 4c06673483
commit f8c587ddcf
5 changed files with 724 additions and 57 deletions
+15
View File
@@ -8,6 +8,21 @@ package test
import java.util.*
import kotlin.test.assertEquals
private val isJava8 = System.getProperty("java.version").startsWith("1.8.")
internal fun testOnJvm8(f: () -> Unit) {
if (isJava8) {
f()
}
}
internal fun testOnJvm9AndAbove(f: () -> Unit) {
if (!isJava8) {
f()
}
}
public actual fun assertTypeEquals(expected: Any?, actual: Any?) {
assertEquals(expected?.javaClass, actual?.javaClass)
}