Skip to content

Prevent path traversal in interaction storage and make Clear All deletion async#1

Merged
cuongmx merged 1 commit intomasterfrom
codex/fix-path-traversal-vulnerability-and-ui-freeze
Mar 28, 2026
Merged

Prevent path traversal in interaction storage and make Clear All deletion async#1
cuongmx merged 1 commit intomasterfrom
codex/fix-path-traversal-vulnerability-and-ui-freeze

Conversation

@cuongmx
Copy link
Copy Markdown
Contributor

@cuongmx cuongmx commented Mar 28, 2026

Motivation

  • Prevent attackers from causing path traversal by supplying crafted unique-id values that are used directly in persistence filenames.
  • Avoid synchronous file I/O on the Swing Event Dispatch Thread during the "Clear All" action to prevent transient UI freezes.

Description

  • Added burp.util.StorageFileUtils which centralizes identifier sanitization (sanitizeIdentifierForFilename) and builds safe storage paths via interactionsFile(File, String).
  • Replaced ad-hoc filename construction with StorageFileUtils.interactionsFile(...) in PollingService, BinTab, and BinService to eliminate path traversal risk when creating/reading/writing interactions-{id}.json.
  • Refactored BinTab Clear All flow to perform persistence-file deletion on a background daemon thread (deletePersistenceFileAsync) and report results back onto the EDT with SwingUtilities.invokeLater, while deletePersistenceFile now returns a boolean indicating success.

Testing

  • Attempted an automated build with mvn -q -DskipTests compile, which failed due to external dependency resolution (Maven Central returned HTTP 403 for maven-resources-plugin), so the code changes were not validated by a successful full build in this environment.

Codex Task

@cuongmx cuongmx merged commit f191c09 into master Mar 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant