Skip to content

path traversal followup #943

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 5 commits into from
Aug 18, 2025
Merged

path traversal followup #943

merged 5 commits into from
Aug 18, 2025

Conversation

oetr
Copy link
Contributor

@oetr oetr commented Aug 8, 2025

This adds an interface to control the file traversal sanitizer:

  • setFilePathTraversalTarget(Supplier<Path>) --- sets the fuzzing target
  • NEW setFilePathTraversalAllowPath(Predicate<Path>) --- a user function that allows/denies file path access

Both can be used to confine the sanitizer configuration to a specific part of the fuzz test. As for example here:

try (SilentCloseable unused = BugDetectors.setFilePathTraversalTarget(() -> Paths.get("/root"))) {
    // Perform operations that require file path traversal sanitization
}

@oetr oetr force-pushed the CIF-1316-path-traversal-followup branch 3 times, most recently from c675743 to 235057d Compare August 8, 2025 15:11
@oetr oetr force-pushed the CIF-1316-path-traversal-followup branch 2 times, most recently from c7e4b96 to be1a252 Compare August 13, 2025 08:18
@oetr oetr force-pushed the CIF-1316-path-traversal-followup branch 8 times, most recently from 18fbda6 to fa61ef4 Compare August 14, 2025 11:52
@oetr oetr marked this pull request as ready for review August 14, 2025 12:06
@oetr oetr requested a review from Copilot August 14, 2025 13:29
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds an interface to control file path traversal sanitization, allowing users to set both a fuzzing target and a predicate to allow/deny file path access through the BugDetectors API.

Key changes:

  • Adds setFilePathTraversalTarget and setFilePathTraversalAllowPath methods to the BugDetectors API
  • Refactors the file path traversal sanitizer to use atomic references instead of system properties
  • Introduces comprehensive test coverage for the new API

Reviewed Changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

Show a summary per file
File Description
BugDetectors.java Adds new file path traversal configuration methods and refactors existing network connection logic
FilePathTraversal.java Complete rewrite replacing system properties with atomic references and improving path handling
FilePathTraversalPass.java New test file for valid path traversal scenarios
FilePathTraversalCrash.java New test file for expected crashes and security findings
FilePathTraversalTest.java Unit tests for path conversion utilities
AbsoluteFilePathTraversal.java Updated to use new BugDetectors API
FilePathTraversal.java (test) Simplified test to remove unused parameters
BUILD.bazel files Updated test configurations and visibility rules

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@oetr oetr force-pushed the CIF-1316-path-traversal-followup branch from fa61ef4 to 5b88bbf Compare August 18, 2025 09:56
@oetr oetr enabled auto-merge (rebase) August 18, 2025 09:56
@oetr oetr merged commit 1840ec2 into main Aug 18, 2025
8 checks passed
@oetr oetr deleted the CIF-1316-path-traversal-followup branch August 18, 2025 10:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants