Path Traversal Vulnerability in MctConfig.java

[decause-gov]

Issue Report

Path Traversal Vulnerability in MctConfig.java

Expected behavior

Limitation of a pathname to a restricted directory.

Actual behavior

Lack of limitation of a pathname to a restricted directory.

/java/src/main/java/org/config/MctConfig.java

public MctNpmPackageValidationSupport mctNpmPackageValidationSupport(
FhirContext fhirContext, MctProperties properties) throws IOException {
MctNpmPackageValidationSupport validationSupport = new
MctNpmPackageValidationSupport(fhirContext);
NpmPackage basePackage;
for (Map.Entry<String, MctProperties.ImplementationGuide> igs :
properties.getImplementationGuides().entrySet()) {
if (igs.getValue().getUrl() != null) {
basePackage = NpmPackage.fromUrl(igs.getValue().getUrl());
}

1. CVE-2023-24057 8.1 Improper Limitation of a Pathname to a Restricted Directory ('Path
   Traversal') vulnerability pending CVSS allocation