{"action":"created","comment":{"url":"https://api.github.com/repos/akka/akka-http/pulls/comments/81108591","pull_request_review_id":2112080,"id":81108591,"diff_hunk":"@@ -233,6 +252,24 @@ object FileAndResourceDirectives extends FileAndResourceDirectives {\n     rec(if (path.startsWithSlash) path.tail else path)\n   }\n \n+  /**\n+   * Check against directory traversal attempts by making sure that the final is a \"true child\"\n+   * of the given base directory.\n+   *\n+   * Returns \"\" if the finalPath is suspicious and the canonical path otherwise.\n+   */\n+  private def checkIsSafeDescendant(basePath: String, finalPath: String, log: LoggingAdapter): String = {\n+    val baseFile = new File(basePath)\n+    val finalFile = new File(finalPath)\n+    val canonicalFinalPath = finalFile.getCanonicalPath\n+\n+    if (!canonicalFinalPath.startsWith(baseFile.getCanonicalPath)) {\n+      log.warning(s\"[$finalFile] points to a location that is not part of [$baseFile]. This might be a directory \" +\n+        \"traversal attempt.\")\n+      \"\"","path":"akka-http/src/main/scala/akka/http/scaladsl/server/directives/FileAndResourceDirectives.scala","position":101,"original_position":101,"commit_id":"a317ca5e9f83bdb3b18dd5c5d85111c812e60289","original_commit_id":"a317ca5e9f83bdb3b18dd5c5d85111c812e60289","user":{"login":"jrudolph","id":9868,"avatar_url":"https://avatars.githubusercontent.com/u/9868?v=3","gravatar_id":"","url":"https://api.github.com/users/jrudolph","html_url":"https://github.com/jrudolph","followers_url":"https://api.github.com/users/jrudolph/followers","following_url":"https://api.github.com/users/jrudolph/following{/other_user}","gists_url":"https://api.github.com/users/jrudolph/gists{/gist_id}","starred_url":"https://api.github.com/users/jrudolph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrudolph/subscriptions","organizations_url":"https://api.github.com/users/jrudolph/orgs","repos_url":"https://api.github.com/users/jrudolph/repos","events_url":"https://api.github.com/users/jrudolph/events{/privacy}","received_events_url":"https://api.github.com/users/jrudolph/received_events","type":"User","site_admin":false},"body":"I just kept the previous behavior of just rejecting the request.","created_at":"2016-09-29T10:38:05Z","updated_at":"2016-09-29T10:38:05Z","html_url":"https://github.com/akka/akka-http/pull/359#discussion_r81108591","pull_request_url":"https://api.github.com/repos/akka/akka-http/pulls/359","_links":{"self":{"href":"https://api.github.com/repos/akka/akka-http/pulls/comments/81108591"},"html":{"href":"https://github.com/akka/akka-http/pull/359#discussion_r81108591"},"pull_request":{"href":"https://api.github.com/repos/akka/akka-http/pulls/359"}}},"pull_request":{"url":"https://api.github.com/repos/akka/akka-http/pulls/359","id":87116054,"html_url":"https://github.com/akka/akka-http/pull/359","diff_url":"https://github.com/akka/akka-http/pull/359.diff","patch_url":"https://github.com/akka/akka-http/pull/359.patch","issue_url":"https://api.github.com/repos/akka/akka-http/issues/359","number":359,"state":"open","locked":false,"title":"Fix directory traversal in Windows in getFromDirectory / listDirectoryContents","user":{"login":"jrudolph","id":9868,"avatar_url":"https://avatars.githubusercontent.com/u/9868?v=3","gravatar_id":"","url":"https://api.github.com/users/jrudolph","html_url":"https://github.com/jrudolph","followers_url":"https://api.github.com/users/jrudolph/followers","following_url":"https://api.github.com/users/jrudolph/following{/other_user}","gists_url":"https://api.github.com/users/jrudolph/gists{/gist_id}","starred_url":"https://api.github.com/users/jrudolph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jrudolph/subscriptions","organizations_url":"https://api.github.com/users/jrudolph/orgs","repos_url":"https://api.github.com/users/jrudolph/repos","events_url":"https://api.github.com/users/jrudolph/events{/privacy}","received_events_url":"https://api.github.com/users/jrudolph/received_events","type":"User","site_admin":false},"body":"@2beaucoup here's a new fix without all your extra changes. AFAICS these should apply also to former versions for which we might have to issue a fix release.\r\n\r\nWDYT about containing the changes inside of the new `safeDirectoryChildPath` (old `fileSystemPath`)?\r\n\r\nFixes #346.","created_at":"2016-09-28T13:07:46Z","updated_at":"2016-09-29T10:38:05Z","closed_at":null,"merged_at":null,"merge_commit_sha":"1243351aa2d6a3495b77fcd0fc70b855d4581d47","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/akka/akka-http/pulls/359/commits","review_comments_url":"https://api.github.com/repos/akka/akka-http/pulls/359/comments","review_comment_url":"https://api.github.com/repos/akka/akka-http/pulls/comments{/number}","comments_url":"https://api.github.com/repos/akka/akka-http/issues/359/comments","statuses_url":"https://api.github.com/repos/akka/akka-http/statuses/a317ca5e9f83bdb3b18dd5c5d85111c812e60289","head":{"label":"akka:w/fix-directory-traversal-under-windows","ref":"w/fix-directory-traversal-under-windows","sha":"a317ca5e9f83bdb3b18dd5c5d85111c812e60289","user":{"login":"akka","id":1496237,"avatar_url":"https://avatars.githubusercontent.com/u/1496237?v=3","gravatar_id":"","url":"https://api.github.com/users/akka","html_url":"https://github.com/akka","followers_url":"https://api.github.com/users/akka/followers","following_url":"https://api.github.com/users/akka/following{/other_user}","gists_url":"https://api.github.com/users/akka/gists{/gist_id}","starred_url":"https://api.github.com/users/akka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akka/subscriptions","organizations_url":"https://api.github.com/users/akka/orgs","repos_url":"https://api.github.com/users/akka/repos","events_url":"https://api.github.com/users/akka/events{/privacy}","received_events_url":"https://api.github.com/users/akka/received_events","type":"Organization","site_admin":false},"repo":{"id":66077955,"name":"akka-http","full_name":"akka/akka-http","owner":{"login":"akka","id":1496237,"avatar_url":"https://avatars.githubusercontent.com/u/1496237?v=3","gravatar_id":"","url":"https://api.github.com/users/akka","html_url":"https://github.com/akka","followers_url":"https://api.github.com/users/akka/followers","following_url":"https://api.github.com/users/akka/following{/other_user}","gists_url":"https://api.github.com/users/akka/gists{/gist_id}","starred_url":"https://api.github.com/users/akka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akka/subscriptions","organizations_url":"https://api.github.com/users/akka/orgs","repos_url":"https://api.github.com/users/akka/repos","events_url":"https://api.github.com/users/akka/events{/privacy}","received_events_url":"https://api.github.com/users/akka/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/akka/akka-http","description":"The Streaming-first HTTP server/module of Akka","fork":false,"url":"https://api.github.com/repos/akka/akka-http","forks_url":"https://api.github.com/repos/akka/akka-http/forks","keys_url":"https://api.github.com/repos/akka/akka-http/keys{/key_id}","collaborators_url":"https://api.github.com/repos/akka/akka-http/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/akka/akka-http/teams","hooks_url":"https://api.github.com/repos/akka/akka-http/hooks","issue_events_url":"https://api.github.com/repos/akka/akka-http/issues/events{/number}","events_url":"https://api.github.com/repos/akka/akka-http/events","assignees_url":"https://api.github.com/repos/akka/akka-http/assignees{/user}","branches_url":"https://api.github.com/repos/akka/akka-http/branches{/branch}","tags_url":"https://api.github.com/repos/akka/akka-http/tags","blobs_url":"https://api.github.com/repos/akka/akka-http/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/akka/akka-http/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/akka/akka-http/git/refs{/sha}","trees_url":"https://api.github.com/repos/akka/akka-http/git/trees{/sha}","statuses_url":"https://api.github.com/repos/akka/akka-http/statuses/{sha}","languages_url":"https://api.github.com/repos/akka/akka-http/languages","stargazers_url":"https://api.github.com/repos/akka/akka-http/stargazers","contributors_url":"https://api.github.com/repos/akka/akka-http/contributors","subscribers_url":"https://api.github.com/repos/akka/akka-http/subscribers","subscription_url":"https://api.github.com/repos/akka/akka-http/subscription","commits_url":"https://api.github.com/repos/akka/akka-http/commits{/sha}","git_commits_url":"https://api.github.com/repos/akka/akka-http/git/commits{/sha}","comments_url":"https://api.github.com/repos/akka/akka-http/comments{/number}","issue_comment_url":"https://api.github.com/repos/akka/akka-http/issues/comments{/number}","contents_url":"https://api.github.com/repos/akka/akka-http/contents/{+path}","compare_url":"https://api.github.com/repos/akka/akka-http/compare/{base}...{head}","merges_url":"https://api.github.com/repos/akka/akka-http/merges","archive_url":"https://api.github.com/repos/akka/akka-http/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/akka/akka-http/downloads","issues_url":"https://api.github.com/repos/akka/akka-http/issues{/number}","pulls_url":"https://api.github.com/repos/akka/akka-http/pulls{/number}","milestones_url":"https://api.github.com/repos/akka/akka-http/milestones{/number}","notifications_url":"https://api.github.com/repos/akka/akka-http/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/akka/akka-http/labels{/name}","releases_url":"https://api.github.com/repos/akka/akka-http/releases{/id}","deployments_url":"https://api.github.com/repos/akka/akka-http/deployments","created_at":"2016-08-19T11:33:36Z","updated_at":"2016-09-26T10:08:28Z","pushed_at":"2016-09-29T09:47:19Z","git_url":"git://github.com/akka/akka-http.git","ssh_url":"git@github.com:akka/akka-http.git","clone_url":"https://github.com/akka/akka-http.git","svn_url":"https://github.com/akka/akka-http","homepage":"http://akka.io","size":19434,"stargazers_count":59,"watchers_count":59,"language":"Scala","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":14,"mirror_url":null,"open_issues_count":267,"forks":14,"open_issues":267,"watchers":59,"default_branch":"master"}},"base":{"label":"akka:master","ref":"master","sha":"ed5cc95266c5d4c00d2482a7a7ff0da9af1353c5","user":{"login":"akka","id":1496237,"avatar_url":"https://avatars.githubusercontent.com/u/1496237?v=3","gravatar_id":"","url":"https://api.github.com/users/akka","html_url":"https://github.com/akka","followers_url":"https://api.github.com/users/akka/followers","following_url":"https://api.github.com/users/akka/following{/other_user}","gists_url":"https://api.github.com/users/akka/gists{/gist_id}","starred_url":"https://api.github.com/users/akka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akka/subscriptions","organizations_url":"https://api.github.com/users/akka/orgs","repos_url":"https://api.github.com/users/akka/repos","events_url":"https://api.github.com/users/akka/events{/privacy}","received_events_url":"https://api.github.com/users/akka/received_events","type":"Organization","site_admin":false},"repo":{"id":66077955,"name":"akka-http","full_name":"akka/akka-http","owner":{"login":"akka","id":1496237,"avatar_url":"https://avatars.githubusercontent.com/u/1496237?v=3","gravatar_id":"","url":"https://api.github.com/users/akka","html_url":"https://github.com/akka","followers_url":"https://api.github.com/users/akka/followers","following_url":"https://api.github.com/users/akka/following{/other_user}","gists_url":"https://api.github.com/users/akka/gists{/gist_id}","starred_url":"https://api.github.com/users/akka/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akka/subscriptions","organizations_url":"https://api.github.com/users/akka/orgs","repos_url":"https://api.github.com/users/akka/repos","events_url":"https://api.github.com/users/akka/events{/privacy}","received_events_url":"https://api.github.com/users/akka/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/akka/akka-http","description":"The Streaming-first HTTP server/module of Akka","fork":false,"url":"https://api.github.com/repos/akka/akka-http","forks_url":"https://api.github.com/repos/akka/akka-http/forks","keys_url":"https://api.github.com/repos/akka/akka-http/keys{/key_id}","collaborators_url":"https://api.github.com/repos/akka/akka-http/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/akka/akka-http/teams","hooks_url":"https://api.github.com/repos/akka/akka-http/hooks","issue_events_url":"https://api.github.com/repos/akka/akka-http/issues/events{/number}","events_url":"https://api.github.com/repos/akka/akka-http/events","assignees_url":"https://api.github.com/repos/akka/akka-http/assignees{/user}","branches_url":"https://api.github.com/repos/akka/akka-http/branches{/branch}","tags_url":"https://api.github.com/repos/akka/akka-http/tags","blobs_url":"https://api.github.com/repos/akka/akka-http/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/akka/akka-http/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/akka/akka-http/git/refs{/sha}","trees_url":"https://api.github.com/repos/akka/akka-http/git/trees{/sha}","statuses_url":"https://api.github.com/repos/akka/akka-http/statuses/{sha}","languages_url":"https://api.github.com/repos/akka/akka-http/languages","stargazers_url":"https://api.github.com/repos/akka/akka-http/stargazers","contributors_url":"https://api.github.com/repos/akka/akka-http/contributors","subscribers_url":"https://api.github.com/repos/akka/akka-http/subscribers","subscription_url":"https://api.github.com/repos/akka/akka-http/subscription","commits_url":"https://api.github.com/repos/akka/akka-http/commits{/sha}","git_commits_url":"https://api.github.com/repos/akka/akka-http/git/commits{/sha}","comments_url":"https://api.github.com/repos/akka/akka-http/comments{/number}","issue_comment_url":"https://api.github.com/repos/akka/akka-http/issues/comments{/number}","contents_url":"https://api.github.com/repos/akka/akka-http/contents/{+path}","compare_url":"https://api.github.com/repos/akka/akka-http/compare/{base}...{head}","merges_url":"https://api.github.com/repos/akka/akka-http/merges","archive_url":"https://api.github.com/repos/akka/akka-http/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/akka/akka-http/downloads","issues_url":"https://api.github.com/repos/akka/akka-http/issues{/number}","pulls_url":"https://api.github.com/repos/akka/akka-http/pulls{/number}","milestones_url":"https://api.github.com/repos/akka/akka-http/milestones{/number}","notifications_url":"https://api.github.com/repos/akka/akka-http/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/akka/akka-http/labels{/name}","releases_url":"https://api.github.com/repos/akka/akka-http/releases{/id}","deployments_url":"https://api.github.com/repos/akka/akka-http/deployments","created_at":"2016-08-19T11:33:36Z","updated_at":"2016-09-26T10:08:28Z","pushed_at":"2016-09-29T09:47:19Z","git_url":"git://github.com/akka/akka-http.git","ssh_url":"git@github.com:akka/akka-http.git","clone_url":"https://github.com/akka/akka-http.git","svn_url":"https://github.com/akka/akka-http","homepage":"http://akka.io","size":19434,"stargazers_count":59,"watchers_count":59,"language":"Scala","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":true,"forks_count":14,"mirror_url":null,"open_issues_count":267,"forks":14,"open_issues":267,"watchers":59,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/akka/akka-http/pulls/359"},"html":{"href":"https://github.com/akka/akka-http/pull/359"},"issue":{"href":"https://api.github.com/repos/akka/akka-http/issues/359"},"comments":{"href":"https://api.github.com/repos/akka/akka-http/issues/359/comments"},"review_comments":{"href":"https://api.github.com/repos/akka/akka-http/pulls/359/comments"},"review_comment":{"href":"https://api.github.com/repos/akka/akka-http/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/akka/akka-http/pulls/359/commits"},"statuses":{"href":"https://api.github.com/repos/akka/akka-http/statuses/a317ca5e9f83bdb3b18dd5c5d85111c812e60289"}}}}
{"actor":{"display_login":"jrudolph"}}