search

hyperledger / fabric-chaincode-java

Hyperledger Fabric Contract and Chaincode implementation for Java
https://hyperledger.github.io/fabric-chaincode-java/
Apache License 2.0
304 stars 207 forks source link

Fix(security): Path Traversal Bug & Arbitrary Code Execution #248

Closed bhaskarvilles closed 2 years ago

bhaskarvilles commented 2 years ago

Primary Changes to /fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn/wrapper/MavenWrapperDownloader.java

ryjones commented 2 years ago

h1

mbwhite commented 2 years ago

@bhaskarvilles the failure of the builds above, I believe, are related to the removal of permissions @ryjones the h1 link is really an issue in maven and fabric-chaincode-java

ryjones commented 2 years ago

@ryjones the h1 link is really an issue in maven and fabric-chaincode-java

I was merely linking for completeness :)

bhaskarvilles commented 2 years ago

@ryjones I invite you as a collaborator please fix the issues.

ryjones commented 2 years ago

@ryjones I invite you as a collaborator please fix the issues.

I can't - please make a new patch that only has your changes

mbwhite commented 2 years ago

Hello; I've double checked into the details more. The maven wrapper is found within two locations

./fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn
./fabric-chaincode-integration-test/src/contracts/wrapper-maven/.mvn

The first - should NOT have the maven wrapper in place, this should be removed, The second - should be updated to use the latest maven wrapper that does have this issue.

@bhaskarvilles are you able to update the PR please? Thanks for spotting the Maven wrapper was an issue.

bhaskarvilles commented 2 years ago

@ryjones I invite you as a collaborator please fix the issues.

I can't - please make a new patch that only has your changes

Let me re Submit the issue with my changes.

bhaskarvilles commented 2 years ago

Hello; I've double checked into the details more. The maven wrapper is found within two locations

./fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn
./fabric-chaincode-integration-test/src/contracts/wrapper-maven/.mvn

The first - should NOT have the maven wrapper in place, this should be removed, The second - should be updated to use the latest maven wrapper that does have this issue.

@bhaskarvilles are you able to update the PR please? Thanks for spotting the Maven wrapper was an issue.

I've tried many times, can you help me with this ?

mbwhite commented 2 years ago

1) This directory needs to be deleted.

./fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn

2) Delete this directory, and then from ./fabric-chaincode-integration-test/src/contracts/wrapper-maven directory recreate the wrapper with mvn wrapper:wrapper

./fabric-chaincode-integration-test/src/contracts/wrapper-maven/.mvn
bhaskarvilles commented 2 years ago
  1. This directory needs to be deleted.
./fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn
  1. Delete this directory, and then from ./fabric-chaincode-integration-test/src/contracts/wrapper-maven directory recreate the wrapper with mvn wrapper:wrapper
./fabric-chaincode-integration-test/src/contracts/wrapper-maven/.mvn

when ever i was trying to clone again it shows file name too long error.

mbwhite commented 2 years ago
  1. This directory needs to be deleted.
./fabric-chaincode-integration-test/src/contracts/bare-maven/.mvn
  1. Delete this directory, and then from ./fabric-chaincode-integration-test/src/contracts/wrapper-maven directory recreate the wrapper with mvn wrapper:wrapper
./fabric-chaincode-integration-test/src/contracts/wrapper-maven/.mvn

when ever i was trying to clone again it shows file name too long error.

Would you be using Windows command line for this?

denyeart commented 2 years ago

Since it had been two weeks, @mbwhite submitted a clean fix at https://github.com/hyperledger/fabric-chaincode-java/pull/254. I'll close this one. Thank you for the report and the contribution!