cloudera / cloudera-scripts-for-log4j

Scripts for addressing log4j zero day security issue
Apache License 2.0
86 stars 68 forks source link

Symlinks are being followed and thus backing up the wrong jar #26

Open starkjs opened 2 years ago

starkjs commented 2 years ago

There is a number of bit of code like

for jarfile in $targetdir/**/*.jar; do

Thus symlinks are being followed and bad things happen, espically with backup of the link name and not the actual file

consider using for jarfile in $(find ${targetdir} -type f -name "*.jar") ; do

belugabehr commented 2 years ago

I agree. This can be better controlled using the find command with the -f flag.

Take a look at #14

jtran-cloudera commented 2 years ago

Thanks for the report. We are looking into a fix.

We may still consider using globs in the scan phase, in case (for whatever reason) symlinks point to jars outside the target folder that might still be loaded.

starkjs commented 2 years ago

Hey @jtran-cloudera, yes, no issue if there is links to file outside of the scan path, but then the script needs to run on that location separately. We can't have it just assume /opt/cloudera is the only place files will exist and follow all the symlinks and then fail to take a backup of the actual file and use the symlink in-stead by accident.