Fix for GHSL-2022-008 vulnerability.

ESAPI · Apr 17, 2022 · a0d67b7 · a0d67b7 · JLLeitschuh · Apr 29, 2022
1 parent 657c2a7
commit a0d67b7
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/main/java/org/owasp/esapi/reference/DefaultValidator.java b/src/main/java/org/owasp/esapi/reference/DefaultValidator.java
@@ -466,7 +466,7 @@ public String getValidDirectoryPath(String context, String input, File parent, b
 			if ( !parent.isDirectory() ) {
 				throw new ValidationException( context + ": Invalid directory name", "Invalid directory, specified parent is not a directory: context=" + context + ", input=" + input + ", parent=" + parent );
 			}
-			if ( !dir.getCanonicalPath().startsWith(parent.getCanonicalPath() ) ) {
+			if ( !dir.getCanonicalFile().toPath().startsWith( parent.getCanonicalFile().toPath() ) ) { // Fixes GHSL-2022-008
 				throw new ValidationException( context + ": Invalid directory name", "Invalid directory, not inside specified parent: context=" + context + ", input=" + input + ", parent=" + parent );
 			}