[jboss-cvs] JBossAS SVN: r58460 - trunk/console/src/main/org/jboss/console/manager
jboss-cvs-commits at lists.jboss.org
jboss-cvs-commits at lists.jboss.org
Thu Nov 16 15:12:20 EST 2006
Author: dimitris at jboss.org
Date: 2006-11-16 15:12:18 -0500 (Thu, 16 Nov 2006)
New Revision: 58460
Modified:
trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepository.java
trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepositoryMBean.java
Log:
JBAS-3861, do not allow writing outside the configured directory
Modified: trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepository.java
===================================================================
--- trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepository.java 2006-11-16 20:10:49 UTC (rev 58459)
+++ trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepository.java 2006-11-16 20:12:18 UTC (rev 58460)
@@ -1,38 +1,38 @@
/*
- * JBoss, Home of Professional Open Source
- * Copyright 2005, JBoss Inc., and individual contributors as indicated
- * by the @authors tag. See the copyright.txt in the distribution for a
- * full listing of individual contributors.
- *
- * This is free software; you can redistribute it and/or modify it
- * under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This software is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this software; if not, write to the Free
- * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
- */
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2006, Red Hat Middleware LLC, and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
package org.jboss.console.manager;
+import java.io.File;
+import java.io.FileOutputStream;
+import java.io.IOException;
+import java.io.PrintWriter;
+
+import javax.management.MBeanServer;
+import javax.management.ObjectName;
+
import org.jboss.system.ServiceMBeanSupport;
import org.jboss.system.server.ServerConfig;
import org.jboss.system.server.ServerConfigLocator;
-import javax.management.ObjectName;
-import javax.management.MBeanServer;
-import java.io.File;
-import java.io.FileOutputStream;
-import java.io.PrintWriter;
-import java.io.IOException;
-import java.net.URL;
-
/**
* This class wraps the file system
* for deployments. It gives a file-based
@@ -44,16 +44,17 @@
* corresponds to the base file name.
*
* @author <a href="mailto:bill at jboss.org">Bill Burke</a>
+ * @author <a href="mailto:dimitris at jboss.org">Dimitris Andreadis</a>
* @version $Revision$
- *
- **/
-public class DeploymentFileRepository extends ServiceMBeanSupport implements DeploymentFileRepositoryMBean
+ */
+public class DeploymentFileRepository extends ServiceMBeanSupport
+ implements DeploymentFileRepositoryMBean
{
private String baseDir;
private File base;
+
/** The server's home directory, for relative paths. */
protected File serverHome;
- protected URL serverHomeURL;
/**
*
@@ -67,8 +68,8 @@
public void store(String folder, String name, String fileExtension, String data, boolean noHotDeploy) throws IOException
{
log.debug("store called");
- File dir = new File(base, folder);
- log.debug("respository folder: " + dir.toString());
+ File dir = getFile(base, folder);
+ log.debug("repository folder: " + dir.toString());
log.debug("absolute: " + dir.getAbsolutePath());
if (!dir.exists())
{
@@ -78,11 +79,13 @@
}
}
String filename = name.replace(' ', '_') + fileExtension;
- File file = new File(dir, filename);
+ File file = getFile(dir, filename);
+
File tmpfile = new File(dir, filename + ".tmp");
PrintWriter writer = new PrintWriter(new FileOutputStream(tmpfile));
writer.write(data);
writer.close();
+
if (file.exists() && noHotDeploy)
{
long modified = file.lastModified();
@@ -95,19 +98,19 @@
}
}
- public void remove(String folder, String name, String fileExtension)
+ public void remove(String folder, String name, String fileExtension) throws IOException
{
- File dir = new File(base, folder);
+ File dir = getFile(base, folder);
String filename = name.replace(' ', '_') + fileExtension;
- File file = new File(dir, filename);
+ File file = getFile(dir, filename);
file.delete();
}
- public boolean isStored(String folder, String name, String fileExtension)
+ public boolean isStored(String folder, String name, String fileExtension) throws IOException
{
- File dir = new File(base, folder);
+ File dir = getFile(base, folder);
String filename = name.replace(' ', '_') + fileExtension;
- File file = new File(dir, filename);
+ File file = getFile(dir, filename);
return file.exists();
}
@@ -116,15 +119,15 @@
return baseDir;
}
- public void setBaseDir(String baseDir)
+ public void setBaseDir(String baseDir) throws IOException
{
+ this.base = getFile(serverHome, baseDir);
this.baseDir = baseDir;
- this.base = new File(serverHome, baseDir);
+
+ log.debug("BaseDir set to: " + this.base);
}
-
- public ObjectName preRegister(MBeanServer server, ObjectName name)
- throws Exception
+ public ObjectName preRegister(MBeanServer server, ObjectName name) throws Exception
{
// get server's home for relative paths, need this for setting
// attribute final values, so we need to do it here
@@ -133,4 +136,20 @@
return super.preRegister(server, name);
}
+ /**
+ * Wrap the File(File parent, String child) CTOR to make sure the
+ * resulting child is indeed under the parent hierarchy,
+ * i.e. don't allow a ../../../rogue-child.txt
+ *
+ * see JBAS-3861
+ */
+ private File getFile(File parent, String child) throws IOException
+ {
+ File childFile = new File(parent, child);
+
+ if (childFile.getCanonicalPath().indexOf(parent.getCanonicalPath()) != 0)
+ throw new IllegalArgumentException("child '" + child + "' should be a child of parent '" + parent + "'");
+
+ return childFile;
+ }
}
Modified: trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepositoryMBean.java
===================================================================
--- trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepositoryMBean.java 2006-11-16 20:10:49 UTC (rev 58459)
+++ trunk/console/src/main/org/jboss/console/manager/DeploymentFileRepositoryMBean.java 2006-11-16 20:12:18 UTC (rev 58460)
@@ -1,46 +1,51 @@
/*
- * JBoss, Home of Professional Open Source
- * Copyright 2005, JBoss Inc., and individual contributors as indicated
- * by the @authors tag. See the copyright.txt in the distribution for a
- * full listing of individual contributors.
- *
- * This is free software; you can redistribute it and/or modify it
- * under the terms of the GNU Lesser General Public License as
- * published by the Free Software Foundation; either version 2.1 of
- * the License, or (at your option) any later version.
- *
- * This software is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this software; if not, write to the Free
- * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
- * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
- */
+ * JBoss, Home of Professional Open Source.
+ * Copyright 2006, Red Hat Middleware LLC, and individual contributors
+ * as indicated by the @author tags. See the copyright.txt file in the
+ * distribution for a full listing of individual contributors.
+ *
+ * This is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU Lesser General Public License as
+ * published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This software is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this software; if not, write to the Free
+ * Software Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA, or see the FSF site: http://www.fsf.org.
+ */
package org.jboss.console.manager;
+import java.io.IOException;
+
import org.jboss.system.ServiceMBean;
-import java.io.IOException;
-
/**
- * Comment
+ * MBean interface
*
* @author <a href="mailto:bill at jboss.org">Bill Burke</a>
+ * @author <a href="mailto:dimitris at jboss.org">Dimitris Andreadis</a>
* @version $Revision$
- *
- **/
+ */
public interface DeploymentFileRepositoryMBean extends ServiceMBean
{
+ // Attributes ----------------------------------------------------
+
+ /** The base directory to use for storing/removing files */
+ void setBaseDir(String baseDir) throws IOException;
+ String getBaseDir();
+
+ // Operations ----------------------------------------------------
+
void store(String folder, String name, String fileExtension, String data, boolean noHotDeploy) throws IOException;
- void remove(String folder, String name, String fileExtension);
+ void remove(String folder, String name, String fileExtension) throws IOException;
- boolean isStored(String folder, String name, String fileExtension);
+ boolean isStored(String folder, String name, String fileExtension) throws IOException;
- String getBaseDir();
-
- void setBaseDir(String baseDir);
}
More information about the jboss-cvs-commits
mailing list