Skip to content

Commit 3fba44e

Browse files
committed
Add logs, remove unnecessary path validation in DefaultGenerator
1 parent 5e28337 commit 3fba44e

File tree

2 files changed

+10
-1
lines changed

2 files changed

+10
-1
lines changed

modules/swagger-codegen/src/main/java/io/swagger/codegen/DefaultGenerator.java

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -804,7 +804,6 @@ public Reader getTemplate(String name) {
804804
.compile(template);
805805

806806
writeToFile(adjustedOutputFilename, tmpl.execute(templateData));
807-
SecureFileUtils.validatePath(adjustedOutputFilename);
808807
return new File(adjustedOutputFilename);
809808
}
810809

modules/swagger-codegen/src/main/java/io/swagger/codegen/utils/SecureFileUtils.java

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,24 @@
33
import java.io.File;
44
import java.io.IOException;
55

6+
import org.slf4j.Logger;
7+
import org.slf4j.LoggerFactory;
8+
69

710
/**
811
* Utility class for secure file operations that prevent path traversal attacks.
912
* Uses a simplified approach focusing on canonical path validation and allowlist-based security.
1013
*/
1114
public class SecureFileUtils {
15+
private static final Logger LOGGER = LoggerFactory.getLogger(SecureFileUtils.class);
1216

1317
private SecureFileUtils() {
1418
// Utility class
1519
}
1620

1721
public static void validatePath(File file) {
1822
if (file == null) {
23+
LOGGER.error("File cannot be null");
1924
throw new IllegalArgumentException("File cannot be null");
2025
}
2126

@@ -24,24 +29,29 @@ public static void validatePath(File file) {
2429
String canonicalPath = file.getCanonicalPath();
2530

2631
if (absolutePath.contains("..") || absolutePath.contains("\0")) {
32+
LOGGER.error("Path contains suspicious characters: {}", absolutePath);
2733
throw new SecurityException("Path contains suspicious characters: " + absolutePath);
2834
}
2935

3036
if (canonicalPath.contains("..") || canonicalPath.contains("\0")) {
37+
LOGGER.error("Path contains suspicious characters: {}", canonicalPath);
3138
throw new SecurityException("Path contains suspicious characters: " + canonicalPath);
3239
}
3340

3441
} catch (IOException e) {
42+
LOGGER.error("Unable to resolve canonical path for: {}, error: {}", file.getAbsolutePath(), e.getMessage());
3543
throw new SecurityException("Unable to resolve canonical path for: " + file.getAbsolutePath(), e);
3644
}
3745
}
3846

3947
public static void validatePath(String path) {
4048
if (path == null || path.trim().isEmpty()) {
49+
LOGGER.error("Path cannot be null or empty");
4150
throw new IllegalArgumentException("Path cannot be null or empty");
4251
}
4352

4453
if (path.contains("..") || path.contains("\0")) {
54+
LOGGER.error("Path contains suspicious characters: {}", path);
4555
throw new SecurityException("Path contains suspicious characters: " + path);
4656
}
4757

0 commit comments

Comments
 (0)