From 4165f918d4bedb6b46cf6ad2bf2f0dc1c1b321c3 Mon Sep 17 00:00:00 2001 From: hr2904 Date: Tue, 11 Jun 2024 14:01:10 +0530 Subject: [PATCH] Removed comments --- .../java/org/apache/atlas/repository/util/FilterUtil.java | 4 ---- .../java/org/apache/atlas/web/filters/ActiveServerFilter.java | 4 ---- 2 files changed, 8 deletions(-) diff --git a/repository/src/main/java/org/apache/atlas/repository/util/FilterUtil.java b/repository/src/main/java/org/apache/atlas/repository/util/FilterUtil.java index 6f244f5d8e..5e3cdd63b2 100644 --- a/repository/src/main/java/org/apache/atlas/repository/util/FilterUtil.java +++ b/repository/src/main/java/org/apache/atlas/repository/util/FilterUtil.java @@ -183,12 +183,9 @@ public static boolean validateFilePath(String fileToImport) { String allowedDirectory = "/var/app/allowed/"; try { - // Decode URL-encoded characters first String decodedPath = URLDecoder.decode(fileToImport, "UTF-8"); Path normalizedPath = Paths.get(decodedPath).normalize(); - - // Check for directory traversal attempts after decoding if (decodedPath.contains("..") || decodedPath.contains("./") || decodedPath.contains(".\\")) { return false; } @@ -205,7 +202,6 @@ public static boolean validateFilePath(String fileToImport) { } catch (UnsupportedEncodingException e) { return false; } catch (Exception e) { - // Handle other exceptions, such as those thrown by Paths.get() for invalid paths return false; } } diff --git a/webapp/src/main/java/org/apache/atlas/web/filters/ActiveServerFilter.java b/webapp/src/main/java/org/apache/atlas/web/filters/ActiveServerFilter.java index 68132f5b77..169afd804a 100644 --- a/webapp/src/main/java/org/apache/atlas/web/filters/ActiveServerFilter.java +++ b/webapp/src/main/java/org/apache/atlas/web/filters/ActiveServerFilter.java @@ -247,16 +247,12 @@ private void handleRedirect(HttpServletRequest servletRequest, HttpServletRespon public static String sanitizeRedirectLocation(String redirectLocation) { if (redirectLocation == null) return null; try { - // Remove CR and LF characters to preemptively prevent response splitting String preProcessedUrl = redirectLocation.replace("\r", "").replace("\n", ""); - // Encode any percent signs not already part of a percent-encoded sequence preProcessedUrl = preProcessedUrl.replaceAll("%(?![0-9a-fA-F]{2})", "%25"); - // URL encode the entire string String encodedUrl = URLEncoder.encode(preProcessedUrl, "UTF-8"); - // Normalize encoded sequences that might be affected by double encoding encodedUrl = encodedUrl.replaceAll("%25([0-9a-fA-F]{2})", "%$1"); return encodedUrl;