Skip to content

Fix code QL security issues #1231

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Dec 2, 2025
Merged

Fix code QL security issues #1231

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2c97906
Fix code QL security issues:
Dec 1, 2025
52125c8
Add directory traversal checks for ZIP extraction
Dec 2, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion dotnet/src/dotnetcore/GxClasses.Web/Middleware/GXRouting.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,9 @@ internal class GXRouting : IGXRouting
public static bool AzureRuntime;
public AzureDeployFeature AzureDeploy = new AzureDeployFeature();
public static string AzureFunctionName;
const int REGEX_DEFAULT_MATCH_TIMEOUT_SECONDS= 10;

static Regex SDSVC_PATTERN = new Regex("([^/]+/)*(sdsvc_[^/]+/[^/]+)(\\?.*)*");
static Regex SDSVC_PATTERN = new Regex("([^/]+/)*(sdsvc_[^/]+/[^/]+)(\\?.*)*", RegexOptions.None, TimeSpan.FromSeconds(REGEX_DEFAULT_MATCH_TIMEOUT_SECONDS));

internal const string PRIVATE_DIR = "private";
public Dictionary<string, string> servicesPathUrl = new Dictionary<string, string>();
Expand Down
2 changes: 1 addition & 1 deletion dotnet/src/dotnetframework/GxClasses/Data/GXDataCommon.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -947,7 +947,7 @@ protected static byte[] GetBinary(string fileNameParm, bool dbBlob)
}
else
{
GXLogging.Error(log, "Not a valid URI: ", fileName);
GXLogging.WarnSanitized(log, "Not a valid URI: ", fileName);
throw new GxADODataException("GxCommand. Not a valid uri: " + fileName);
}
return binary;
Expand Down
12 changes: 1 addition & 11 deletions dotnet/src/dotnetframework/GxClasses/Helpers/GXMetadata.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,19 +226,9 @@ static public object FindInstance(string defaultAssemblyName, string clss, Objec
static public object FindInstance(string defaultAssemblyName, string nspace, string clss, Object[] constructorArgs, Assembly defaultAssembly, bool ignoreCase=false)
{
Type objType = FindType( defaultAssemblyName, nspace, clss, defaultAssembly, ignoreCase);
GXLogging.Debug(log, "CreateInstance, Args ", ConstructorArgsString(constructorArgs));
GXLogging.Debug(log, "CreateInstance class:", clss);
return Activator.CreateInstance(objType, constructorArgs);
}
internal static string ConstructorArgsString(Object[] constructorArgs)
{
string argsConstr = "";
for (int i = 0; constructorArgs != null && i < constructorArgs.Length; i++)
{
argsConstr += "'" + constructorArgs[i] + "' ";
}
return argsConstr;
}

static public void ExecuteVoidRef(object o, string mthd, Object[] args)
{
try
Expand Down
16 changes: 16 additions & 0 deletions dotnet/src/dotnetframework/GxCompress/GXCompressor.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -603,6 +603,14 @@ private static void DecompressZip(FileInfo file, string outputPath)
foreach (var entry in archive.Entries)
{
string fullPath = Path.Combine(outputPath, entry.FullName);
string destFileName = Path.GetFullPath(fullPath);
string fullDestDirPath = Path.GetFullPath(outputPath + Path.DirectorySeparatorChar);
if (!destFileName.StartsWith(fullDestDirPath))
{
throw new InvalidOperationException("Entry is outside the target dir: " + destFileName);
}


if (string.IsNullOrEmpty(entry.Name))
{
Directory.CreateDirectory(fullPath);
Expand Down Expand Up @@ -742,6 +750,14 @@ private static void DecompressJar(FileInfo file, string outputPath)
foreach (var entry in archive.Entries)
{
string destinationPath = Path.Combine(outputPath, entry.FullName);
string destFileName = Path.GetFullPath(destinationPath);
string fullDestDirPath = Path.GetFullPath(outputPath + Path.DirectorySeparatorChar);
if (!destFileName.StartsWith(fullDestDirPath))
{
throw new InvalidOperationException("Entry is outside the target dir: " + destFileName);
}


if (string.IsNullOrEmpty(entry.Name))
{
Directory.CreateDirectory(destinationPath);
Expand Down
Loading