[NOID] Fixes failing path traversal TeamCity tests (#464)

neo4j · Aug 2, 2023 · dd479fc · dd479fc
1 parent f481e96
commit dd479fc
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 14 deletions.
diff --git a/.github/actions/setup-jdk/action.yaml b/.github/actions/setup-jdk/action.yaml
@@ -6,5 +6,5 @@ runs:
     - name: Set up JDK 17
       uses: actions/setup-java@v3
       with:
-        java-version: '17'
+        java-version: '17.0.8'
         distribution: 'temurin'
diff --git a/core/src/test/java/apoc/export/ExportCoreSecurityTest.java b/core/src/test/java/apoc/export/ExportCoreSecurityTest.java
@@ -155,13 +155,10 @@ public TestIllegalExternalFSAccess(String exportMethod, String exportMethodType,
         // non-failing cases, with apoc.import.file.use_neo4j_config=false
         public static final List<String> casesAllowed = Arrays.asList(case03, case04, case05);
 
-        private static final String case06 = "file:///%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2fapoc/" + FILENAME;
-        public static final String case07 = "file:///%2e%2e%2f%2f" + FILENAME;
-        private static final String case08 = "tests/../../" + FILENAME;
-        private static final String case09 = "tests/..//..//" + FILENAME;
+        private static final String case07 = "tests/../../" + FILENAME;
+        private static final String case08 = "tests/..//..//" + FILENAME;
 
-        public static final List<String> casesOutsideDir = Arrays.asList(case01, case02, case03, case04, case05,
-                case06, case07, case08, case09);
+        public static final List<String> casesOutsideDir = Arrays.asList(case01, case02, case03, case04, case05, case07, case08);
 
         /*
          All of these will resolve to a local path after normalization which will point to
@@ -229,10 +226,6 @@ public void testWithUseNeo4jConfDisabled() {
         }
 
         private void testWithUseNeo4jConfFalse() {
-            // with `apoc.import.file.use_neo4j_config=false` this file export could outside the project
-            if (fileName.equals(case07)) {
-                return;
-            }
 
             try {
                 assertPathTraversalWithoutErrors();
@@ -285,8 +278,10 @@ They result in a file being created (and deleted after).
         private static final String case06 = "file:///tests//..//" + FILENAME;
         private static final String case07 = "" + FILENAME;
         private static final String case08 = "file:///..//..//..//..//" + FILENAME;
+        private static final String case09 = "file:///%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f%2e%2e%2f%2f/" + FILENAME;
+        public static final String case10 = "file:///%2e%2e%2f%2f" + FILENAME;
 
-        public static final List<String> mainDirCases = Arrays.asList(caseBase, case01, case02, case03, case04, case05, case06, case07, case08);
+        public static final List<String> mainDirCases = Arrays.asList(caseBase, case01, case02, case03, case04, case05, case06, case07, case08, case09, case10);
 
         /*
          These tests normalize the path to be within the import directory and step into a subdirectory

diff --git a/core/src/test/java/apoc/export/arrow/ExportArrowSecurityTest.java b/core/src/test/java/apoc/export/arrow/ExportArrowSecurityTest.java
@@ -46,7 +46,7 @@
 
 import static apoc.export.ExportCoreSecurityTest.FILENAME;
 import static apoc.export.ExportCoreSecurityTest.PARAM_NAMES;
-import static apoc.export.ExportCoreSecurityTest.TestIllegalExternalFSAccess.case07;
+import static apoc.export.ExportCoreSecurityTest.TestPathTraversalIsNormalisedWithinDirectory.case10;
 import static apoc.export.ExportCoreSecurityTest.TestIllegalExternalFSAccess.EXCEPTION_NOT_FOUND_CONSUMER;
 import static apoc.export.ExportCoreSecurityTest.TestIllegalExternalFSAccess.dataPairs;
 import static apoc.export.ExportCoreSecurityTest.TestPathTraversalIsNormalisedWithinDirectory.MAIN_DIR_CONSUMER;
@@ -153,7 +153,7 @@ public void testWithUseNeo4jConfDisabled() {
 
         private void testWithUseNeo4jConfFalse() {
             // with `apoc.import.file.use_neo4j_config=false` this file export could outside the project
-            if (fileName.equals(case07)) {
+            if (fileName.equals(case10)) {
                 return;
             }