File tree Expand file tree Collapse file tree
robocode.core/src/main/java/net/sf/robocode/cachecleaner Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -56,18 +56,30 @@ private static void deleteFile(String filename) {
5656 }
5757 }
5858
59- private static void recursivelyDelete (File file ) throws IOException {
60- if (file .exists ()) {
61- if (file .isDirectory ()) {
62- final File [] files = file .listFiles ();
63-
64- for (File f : files ) {
65- recursivelyDelete (f );
66- }
67- }
68- if (!file .delete ()) {
69- throw new IOException ("Failed deleting file: " + file .getPath ());
70- }
71- }
59+ private static void recursivelyDelete (File file , File base ) throws IOException {
60+ if (!file .exists ()) {
61+ return ;
62+ }
63+
64+ // Security check to prevent directory traversal attacks
65+ if (!(file .getCanonicalFile ().toPath ().startsWith (base .getCanonicalFile ().toPath ()))) {
66+ throw new IOException ("Security violation: Attempting to delete a file outside the allowed base directory: "
67+ + file .getCanonicalPath ());
68+ }
69+
70+ if (file .isDirectory ()) {
71+ final File [] files = file .listFiles ();
72+
73+ // Null check for file listing
74+ if (files != null ) {
75+ for (File f : files ) {
76+ recursivelyDelete (f , base );
77+ }
78+ }
79+ }
80+
81+ if (!file .delete ()) {
82+ throw new IOException ("Failed deleting file: " + file .getPath ());
83+ }
84+ }
7285 }
73- }
You can’t perform that action at this time.
0 commit comments