File ant-CVE-2020-11979-1.patch of Package ant.26115
From f7159e8a084a3fcb76b933d393df1fc855d74d78 Mon Sep 17 00:00:00 2001
From: Stefan Bodewig <bodewig@apache.org>
Date: Tue, 28 Jul 2020 21:51:01 +0200
Subject: [PATCH] document why we are actually removing the file before writing
---
.../org/apache/tools/ant/types/resources/FileResource.java | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
Index: apache-ant-1.9.4/src/main/org/apache/tools/ant/types/resources/FileResource.java
===================================================================
--- apache-ant-1.9.4.orig/src/main/org/apache/tools/ant/types/resources/FileResource.java
+++ apache-ant-1.9.4/src/main/org/apache/tools/ant/types/resources/FileResource.java
@@ -24,6 +24,8 @@ import java.io.OutputStream;
import java.io.FileInputStream;
import java.io.FileOutputStream;
+import java.nio.file.Files;
+
import org.apache.tools.ant.Project;
import org.apache.tools.ant.BuildException;
import org.apache.tools.ant.util.FileUtils;
@@ -247,7 +249,8 @@ public class FileResource extends Resour
private OutputStream getOutputStream(boolean append) throws IOException {
File f = getNotNullFile();
if (f.exists()) {
- if (f.isFile() && !append) {
+ if (Files.isSymbolicLink(f.toPath()) && f.isFile() && !append) {
+ // https://bz.apache.org/bugzilla/show_bug.cgi?id=624
f.delete();
}
} else {