From 18414fe3b5c14f7d64f00d241cb9d8bf4a1b6609 Mon Sep 17 00:00:00 2001 From: wizjany Date: Fri, 15 Mar 2019 09:10:51 -0400 Subject: [PATCH] Fix symlink detection. --- .../src/main/java/com/sk89q/worldedit/WorldEdit.java | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/worldedit-core/src/main/java/com/sk89q/worldedit/WorldEdit.java b/worldedit-core/src/main/java/com/sk89q/worldedit/WorldEdit.java index 8dbd65389..22ea5b38e 100644 --- a/worldedit-core/src/main/java/com/sk89q/worldedit/WorldEdit.java +++ b/worldedit-core/src/main/java/com/sk89q/worldedit/WorldEdit.java @@ -284,12 +284,18 @@ public final class WorldEdit { Path filePath = Paths.get(f.toURI()).normalize(); Path dirPath = Paths.get(dir.toURI()).normalize(); - if (!filePath.startsWith(dirPath) - || (!getConfiguration().allowSymlinks && !filePath.toRealPath().startsWith(dirPath))) { + boolean inDir = filePath.startsWith(dirPath); + Path existingParent = filePath; + do { + existingParent = existingParent.getParent(); + } while (existingParent != null && !existingParent.toFile().exists()); + + boolean isSym = existingParent != null && !existingParent.toRealPath().equals(existingParent); + if (!inDir || (!getConfiguration().allowSymlinks && isSym)) { throw new FilenameResolutionException(filename, "Path is outside allowable root"); } - return f; + return filePath.toFile(); } catch (IOException e) { throw new FilenameResolutionException(filename, "Failed to resolve path"); }