FileLocatorStrategy.java line 33
The locationSpecification string is passed directly to new File(locationSpecification) without normalization or sanitization. If this input originates from an untrusted source, sequences such as ../ can resolve to files outside the intended directory.
Note: This is low priority because in a Maven plugin context the POM is typically trusted.
Bug #15
FileLocatorStrategy.javaline 33The
locationSpecificationstring is passed directly tonew File(locationSpecification)without normalization or sanitization. If this input originates from an untrusted source, sequences such as../can resolve to files outside the intended directory.Note: This is low priority because in a Maven plugin context the POM is typically trusted.