Report some code that may cause security issues.

[Xiqinger]

Describe the bug

1. Path Travel

version >= 6.*

file

Merely checking the compliance of files during creation is insufficient to ensure security. Additional validation is required to verify the compliance of directory creation, as failure to do so may result in system instability or exploitation by other attacks.

Recommend：
Move the path validation statement from line 1968 to before line 1960.

2. Open Redirect

version <=6.*

file

"request.getContextPath" return the path starts with a "/" character but does not end with a "/" character.
So, "controlledvocabularytag".startsWith("controlledvocabulary") = true. The URL may escape the base URL, potentially leading to security vulnerabilities.

Recommend:
For example, by replacing the condition "callerUrl.equals(contextPath)" with "callerUrl.equals(contextPath) || callerUrl.startsWith(contextPath + "/")" to ensure proper validation.

3. no hasNext before call next()

version = 7.*

file

I couldn't find the code logic that ensures the 'bundles' and 'getItems()' are not empty. If it cannot be guaranteed, it is recommended to perform a 'hasNext' check before calling 'next' to avoid potential NullPointerExceptions or unexpected behavior.

Additionally, I have identified a similar issue in the 'ItemImportServiceImpl'. However, upon manual analysis, it appears that if 'mycollections' is null, the 'addItem' method may not be executed. Due to the complexity of the code logic, it is uncertain whether this behavior is intentional or a potential oversight. Further investigation and clarification are recommended to ensure the expected behavior of the code.

4. [just recommend] ByteArrayOutputStream use after close

version = 7.*

file

'ByteArrayOutputStream out' variable may be closed within the 'disseminate' method. However, within the loop, 'out' is still being used through the 'write' operation. Because the 'close' method of 'ByteArrayOutputStream' has no effect, it is not a bug. But it's not recommended.

[tdonohue]

@Xiqinger : If you or someone on your team can find time to send us Pull Requests to resolve any of these issues, we can give them a review/test. Keep in mind that DSpace 6 and below are no longer under support, so issues in those releases will not be fixed. But, we welcome pull requests to fix DSpace 7 issues.

DSpace is built/maintained by it's community of volunteers. So, if you don't find time to send a PR, then we'll do our best to locate a different volunteer to analyze this ticket to see how best to resolve these issues. Thanks.