|
What this is
Other links
The source code/* * $Header: /home/cvs/jakarta-tomcat/src/share/org/apache/tomcat/util/io/FileUtil.java,v 1.13 2004/02/25 07:47:52 billbarker Exp $ * $Revision: 1.13 $ * $Date: 2004/02/25 07:47:52 $ * * * Copyright 1999-2004 The Apache Sofware Foundation. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. * You may obtain a copy of the License at * * http://www.apache.org/licenses/LICENSE-2.0 * * Unless required by applicable law or agreed to in writing, software * distributed under the License is distributed on an "AS IS" BASIS, * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. * See the License for the specific language governing permissions and * limitations under the License. */ package org.apache.tomcat.util.io; import java.io.File; import java.io.FileInputStream; import java.io.FileNotFoundException; import java.io.FileOutputStream; import java.io.IOException; import java.util.zip.ZipEntry; import java.util.zip.ZipInputStream; /* * FileUtil contains utils for dealing with Files. Some of these are * already present in JDK 1.2 but since we can rely on that and need * to run on both JDK 1.1.x and JDK 1.2, we are replicating some of * that code here. * * FileUtil also takes care of File.getAbsolutePath() and * File.getNamePath() troubles when running on JDK 1.1.x/Windows * * @author James Todd [gonzo@eng.sun.com] * @author Anil K. Vijendran [akv@eng.sun.com] */ public class FileUtil { static final String osName = System.getProperty("os.name"); public static File[] listFiles(File dir) { String[] ss = dir.list(); if (ss == null) return null; int n = ss.length; File[] fs = new File[n]; for(int i = 0; i < n; i++) { fs[i] = new File(dir.getPath(), ss[i]); } return fs; } /** Will concatenate 2 paths, dealing with .. * ( /a/b/c + d = /a/b/d, /a/b/c + ../d = /a/d ) * Used in Request.getRD * @return null if error occurs */ public static String catPath(String lookupPath, String path) { // Cut off the last slash and everything beyond int index = lookupPath.lastIndexOf("/"); lookupPath = lookupPath.substring(0, index); // Deal with .. by chopping dirs off the lookup path while (path.startsWith("../")) { if (lookupPath.length() > 0) { index = lookupPath.lastIndexOf("/"); lookupPath = lookupPath.substring(0, index); } else { // More ..'s than dirs, return null return null; } index = path.indexOf("../") + 3; path = path.substring(index); } return lookupPath + "/" + path; } // XXX tc_log is the default channel in tomcat, this component //should be able to log in a specific channel. static org.apache.commons.logging.Log logger = org.apache.commons.logging.LogFactory.getLog(FileUtil.class); /** All the safety checks from getRealPath() and DefaultServlet. */ public static String safePath( String base, String path ) { return safePath(base, path, true); } /** All the safety checks from getRealPath() and DefaultServlet. */ public static String safePath( String base, String path, boolean caseSf ) { // Hack for Jsp ( and other servlets ) that use rel. paths // if( ! path.startsWith("/") ) path="/"+ path; if( path==null || path.equals("") ) return base; String normP=path; if( path.indexOf('\\') >=0 ) normP= path.replace('\\', '/'); if ( !normP.startsWith("/")) normP = "/" + normP; int index = normP.indexOf("/../"); if (index >= 0) { // Clean out "//" and "/./" so they will not be confused // with real parent directories int index2 = 0; while ((index2 = normP.indexOf("//", index2)) >= 0) { normP = normP.substring(0, index2) + normP.substring(index2 + 1); if (index2 < index) index--; } index2 = 0; while ((index2 = normP.indexOf("/./", index2)) >= 0) { normP = normP.substring(0, index2) + normP.substring(index2 + 2); if (index2 < index) index -= 2; } // Remove cases of "/{directory}/../" while (index >= 0) { // If no parent directory to remove, return null if (index == 0) return (null); // Trying to leave our context index2 = normP.lastIndexOf('/', index-1); normP = normP.substring(0, index2) + normP.substring(index + 3); index = normP.indexOf("/../", index2); } } String realPath= base + normP; // Probably not needed - it will be used on the local FS realPath = FileUtil.patch(realPath); String canPath=null; try { canPath=new File(realPath).getCanonicalPath(); } catch( IOException ex ) { logger.error("in safePath(" + base +", "+path + "), realPath=" + realPath, ex); return null; } // This absPath/canPath comparison plugs security holes... // On Windows, makes "x.jsp.", "x.Jsp", and "x.jsp%20" // return 404 instead of the JSP source // On all platforms, makes sure we don't let ../'s through // Unfortunately, on Unix, it prevents symlinks from working // So, a check for File.separatorChar='\\' ..... It hopefully // happens on flavors of Windows. if (File.separatorChar == '\\') { // On Windows check ignore case.... if (!realPath.equals(canPath)){ int ls = realPath.lastIndexOf('\\'); if(ls > 0 && !realPath.substring(0,ls).equals(canPath)) { if(caseSf || !realPath.equalsIgnoreCase(canPath)) return null; } } } // The following code on Non Windows disallows ../ // in the path but also disallows symlinks.... // // if( ! canPath.startsWith(base) ) { // // no access to files in a different context. // return null; // } // if(!absPath.equals(canPath)) { // response.sendError(response.SC_NOT_FOUND); // return; // } // instead lets look for ".." in the absolute path // and disallow only that. // Why should we loose out on symbolic links? // if(realPath.indexOf("..") != -1) { // We have .. in the path... return null; } // extra-extra safety check, ( but slow ) return realPath; } public static String patch(String path) { String patchPath = path; // Move drive spec to the front of the path if (patchPath.length() >= 3 && patchPath.charAt(0) == '/' && Character.isLetter(patchPath.charAt(1)) && patchPath.charAt(2) == ':') { patchPath=patchPath.substring(1,3)+"/"+patchPath.substring(3); } // Eliminate consecutive slashes after the drive spec if (patchPath.length() >= 2 && Character.isLetter(patchPath.charAt(0)) && patchPath.charAt(1) == ':') { char[] ca = patchPath.replace('/', '\\').toCharArray(); char c; StringBuffer sb = new StringBuffer(); for (int i = 0; i < ca.length; i++) { if ((ca[i] != '\\') || (ca[i] == '\\' && i > 0 && ca[i - 1] != '\\')) { if (i == 0 && Character.isLetter(ca[i]) && i < ca.length - 1 && ca[i + 1] == ':') { c = Character.toUpperCase(ca[i]); } else { c = ca[i]; } sb.append(c); } } patchPath = sb.toString(); } // fix path on NetWare - all '/' become '\\' and remove duplicate '\\' if (osName.startsWith("NetWare") && path.length() >=3 && path.indexOf(':') > 0) { char[] ca = patchPath.replace('/', '\\').toCharArray(); StringBuffer sb = new StringBuffer(); for (int i = 0; i < ca.length; i++) { if ((ca[i] != '\\') || (ca[i] == '\\' && i > 0 && ca[i - 1] != '\\')) { sb.append(ca[i]); } } patchPath = sb.toString(); } return patchPath; } public static boolean isAbsolute( String path ) { // normal file if( path.startsWith("/" ) ) return true; if( path.startsWith(File.separator ) ) return true; // win c: if (path.length() >= 3 && Character.isLetter(path.charAt(0)) && path.charAt(1) == ':') return true; // NetWare volume: if (osName.startsWith("NetWare") && path.length() >=3 && path.indexOf(':') > 0) return true; return false; } // Used in few places. public static String getCanonicalPath(String name ) { if( name==null ) return null; File f = new File(name); try { return f.getCanonicalPath(); } catch (IOException ioe) { System.err.println("getCanonicalPath(" + name + ")"); ioe.printStackTrace(); return name; // oh well, we tried... } } public static String removeLast( String s) { int i = s.lastIndexOf("/"); if (i > 0) { s = s.substring(0, i); } else if (i == 0 && ! s.equals("/")) { s = "/"; } else { s = ""; } return s; } public static String getExtension( String path ) { int i = path.lastIndexOf("."); int j = path.lastIndexOf(File.separator); if ((i > 0) && (i > j)) return path.substring(i); else return null; } /** Name without path and extension. */ public static String getBase( String path ) { int i = path.lastIndexOf("."); int j = path.lastIndexOf(File.separator); if( j < 0 ) {// no / if( i<0 ) return path; else return path.substring( 0, i ); } else { if( i |
... this post is sponsored by my books ... | |
#1 New Release! |
FP Best Seller |
Copyright 1998-2024 Alvin Alexander, alvinalexander.com
All Rights Reserved.
A percentage of advertising revenue from
pages under the /java/jwarehouse
URI on this website is
paid back to open source projects.