fix : path traversal StaticBucketRouter

adorsys · Sep 19, 2024 · 16f453a · 16f453a
1 parent 32d36bc
commit 16f453a
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/...storage-impl-s3/src/main/java/de/adorsys/datasafe/storage/impl/s3/StaticBucketRouter.java b/...storage-impl-s3/src/main/java/de/adorsys/datasafe/storage/impl/s3/StaticBucketRouter.java
@@ -20,10 +20,10 @@ public String resourceKey(AbsoluteLocation resource) {
  UnaryOperator<String> trimStartingSlash = str -> str.replaceFirst("^/", "");
 
  String resourcePath = trimStartingSlash.apply(resource.location().getRawPath());
- if (bucketName == null || "".equals(bucketName) || !resourcePath.contains(bucketName)) {
+ if (bucketName == null || "".equals(bucketName) || !resourcePath.startsWith(bucketName)) {
  return resourcePath;
  }
 
- return trimStartingSlash.apply(resourcePath.substring(resourcePath.indexOf(bucketName) + bucketName.length()));
+ return trimStartingSlash.apply(resourcePath.substring(bucketName.length()));
  }
 }