Attachment #16397 for bug #46459

This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

View | Details | Raw Unified | Return to bug 46459
Collapse All | Expand All





package org.openide.filesystems;

import java.io.File;
import java.io.FileFilter;
import java.io.FilenameFilter;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.SyncFailedException;
import java.net.MalformedURLException;
import java.net.URI;
import java.net.URL;
import java.net.URLStreamHandler;
import java.util.Arrays;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.Map;
import java.util.Set;
import java.util.StringTokenizer;
import java.util.WeakHashMap;
import java.util.jar.JarEntry;
import java.util.jar.JarInputStream;
import javax.swing.Icon;
import javax.swing.JFileChooser;
import javax.swing.filechooser.FileSystemView;
import org.openide.ErrorManager;

import org.openide.util.Utilities;
import org.openide.util.NbBundle;
import org.openide.util.Utilities;

/** Common utilities for handling files.
 * This is a dummy class; all methods are static.

            }
        } else {
            // On Unix, do not want to traverse symlinks.
            if (file.getAbsolutePath().equals("/..")) { // NOI18N
                // Special treatment.
                file = new File("/"); // NOI18N
            } else {
                // URI.normalize removes ../ and ./ sequences nicely.
                file = new File(file.toURI().normalize()).getAbsoluteFile();
            }
        }
        return file;
    }

            return index != -1 && index > urlPath.lastIndexOf('/');
        }
    }
    
    /**
     * Make sure that a JFileChooser does not traverse symlinks on Unix.
     * @see <a href="http://www.netbeans.org/issues/show_bug.cgi?id=46014">Issue #46014</a>
     * @see <a href="http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4906607">JRE bug #4906607</a>
     * @since XXX
     */
    public static void preventFileChooserSymlinkTraversal(JFileChooser jfc) {
        if (!Utilities.isWindows()) {
            jfc.setCurrentDirectory(wrapFileNoCanonicalize(jfc.getCurrentDirectory()));
            jfc.setFileSystemView(new NonCanonicalizingFileSystemView());
        }
    }

    private static File wrapFileNoCanonicalize(File f) {
        if (f instanceof NonCanonicalizingFile) {
            return f;
        } else if (f != null) {
            return new NonCanonicalizingFile(f);
        } else {
            return null;
        }
    }
    
    private static File[] wrapFilesNoCanonicalize(File[] fs) {
        if (fs != null) {
            for (int i = 0; i < fs.length; i++) {
                fs[i] = wrapFileNoCanonicalize(fs[i]);
            }
        }
        return fs;
    }
    
    private static final class NonCanonicalizingFile extends File {
        public NonCanonicalizingFile(File orig) {
            this(orig.getPath());
        }
        private NonCanonicalizingFile(String path) {
            super(path);
        }
        private NonCanonicalizingFile(URI uri) {
            super(uri);
        }
        public File getCanonicalFile() throws IOException {
            return wrapFileNoCanonicalize(normalizeFile(this));
        }
        public String getCanonicalPath() throws IOException {
            return normalizeFile(this).getAbsolutePath();
        }
        public File getParentFile() {
            return wrapFileNoCanonicalize(super.getParentFile());
        }
        public File getAbsoluteFile() {
            return wrapFileNoCanonicalize(super.getAbsoluteFile());
        }
        public File[] listFiles() {
            return wrapFilesNoCanonicalize(super.listFiles());
        }
        public File[] listFiles(FileFilter filter) {
            return wrapFilesNoCanonicalize(super.listFiles(filter));
        }
        public File[] listFiles(FilenameFilter filter) {
            return wrapFilesNoCanonicalize(super.listFiles(filter));
        }
    }
    
    private static final class NonCanonicalizingFileSystemView extends FileSystemView {
        private final FileSystemView delegate = FileSystemView.getFileSystemView();
        public NonCanonicalizingFileSystemView() {}
        public boolean isFloppyDrive(File dir) {
            return delegate.isFloppyDrive(dir);
        }
        public boolean isComputerNode(File dir) {
            return delegate.isComputerNode(dir);
        }
        public File createNewFolder(File containingDir) throws IOException {
            return wrapFileNoCanonicalize(delegate.createNewFolder(containingDir));
        }
        public boolean isDrive(File dir) {
            return delegate.isDrive(dir);
        }
        public boolean isFileSystemRoot(File dir) {
            return delegate.isFileSystemRoot(dir);
        }
        public File getHomeDirectory() {
            return wrapFileNoCanonicalize(delegate.getHomeDirectory());
        }
        public File createFileObject(File dir, String filename) {
            return wrapFileNoCanonicalize(delegate.createFileObject(dir, filename));
        }
        public Boolean isTraversable(File f) {
            return delegate.isTraversable(f);
        }
        public boolean isFileSystem(File f) {
            return delegate.isFileSystem(f);
        }
        /*
        protected File createFileSystemRoot(File f) {
            return translate(delegate.createFileSystemRoot(f));
        }
         */
        public File getChild(File parent, String fileName) {
            return wrapFileNoCanonicalize(delegate.getChild(parent, fileName));
        }
        public File getParentDirectory(File dir) {
            return wrapFileNoCanonicalize(delegate.getParentDirectory(dir));
        }
        public Icon getSystemIcon(File f) {
            return delegate.getSystemIcon(f);
        }
        public boolean isParent(File folder, File file) {
            return delegate.isParent(folder, file);
        }
        public String getSystemTypeDescription(File f) {
            return delegate.getSystemTypeDescription(f);
        }
        public File getDefaultDirectory() {
            return wrapFileNoCanonicalize(delegate.getDefaultDirectory());
        }
        public String getSystemDisplayName(File f) {
            return delegate.getSystemDisplayName(f);
        }
        public File[] getRoots() {
            return wrapFilesNoCanonicalize(delegate.getRoots());
        }
        public boolean isHiddenFile(File f) {
            return delegate.isHiddenFile(f);
        }
        public File[] getFiles(File dir, boolean useFileHiding) {
            return wrapFilesNoCanonicalize(delegate.getFiles(dir, useFileHiding));
        }
        public boolean isRoot(File f) {
            return delegate.isRoot(f);
        }
        public File createFileObject(String path) {
            return wrapFileNoCanonicalize(delegate.createFileObject(path));
        }
    }

}

Lines 383-388 Link Here

(-)projects/projectui/src/org/netbeans/modules/project/ui/ProjectChooserAccessory.java (+1 lines)
383	if ( defaultAccessory ) {	383	if ( defaultAccessory ) {
384	chooser.setAccessory( new ProjectChooserAccessory( chooser, opls.isOpenSubprojects(), opls.isOpenAsMain() ) );	384	chooser.setAccessory( new ProjectChooserAccessory( chooser, opls.isOpenSubprojects(), opls.isOpenAsMain() ) );
385	}	385	}
		386	FileUtil.preventFileChooserSymlinkTraversal(chooser);
386	chooser.setFileView( new ProjectFileView( chooser.getFileSystemView() ) );	387	chooser.setFileView( new ProjectFileView( chooser.getFileSystemView() ) );
387		388
388	String dir = opls.getLastOpenProjectDir();	389	String dir = opls.getLastOpenProjectDir();

Return to bug 46459

Lines 13-30 Link Here

(-)openide/src/org/openide/filesystems/FileUtil.java (-9 / +168 lines)
13		13
14	package org.openide.filesystems;	14	package org.openide.filesystems;
15		15
16	import org.openide.util.WeakListeners;	16	import java.io.File;
17	import java.io.*;	17	import java.io.FileFilter;
18	import java.net.URLStreamHandler;	18	import java.io.FilenameFilter;
19	import java.net.URL;	19	import java.io.IOException;
		20	import java.io.InputStream;
		21	import java.io.OutputStream;
		22	import java.io.SyncFailedException;
20	import java.net.MalformedURLException;	23	import java.net.MalformedURLException;
21	import java.net.URI;	24	import java.net.URI;
22	import java.util.*;	25	import java.net.URL;
23	import java.util.jar.*;	26	import java.net.URLStreamHandler;
		27	import java.util.Arrays;
		28	import java.util.Enumeration;
		29	import java.util.HashMap;
		30	import java.util.HashSet;
		31	import java.util.Iterator;
		32	import java.util.Map;
		33	import java.util.Set;
		34	import java.util.StringTokenizer;
		35	import java.util.WeakHashMap;
		36	import java.util.jar.JarEntry;
		37	import java.util.jar.JarInputStream;
		38	import javax.swing.Icon;
		39	import javax.swing.JFileChooser;
		40	import javax.swing.filechooser.FileSystemView;
24	import org.openide.ErrorManager;	41	import org.openide.ErrorManager;
25
26	import org.openide.util.Utilities;
27	import org.openide.util.NbBundle;	42	import org.openide.util.NbBundle;
		43	import org.openide.util.Utilities;
28		44
29	/** Common utilities for handling files.	45	/** Common utilities for handling files.
30	* This is a dummy class; all methods are static.	46	* This is a dummy class; all methods are static.
Lines 930-936 Link Here
930	}	946	}
931	} else {	947	} else {
932	// On Unix, do not want to traverse symlinks.	948	// On Unix, do not want to traverse symlinks.
933	file = new File(file.toURI().normalize()).getAbsoluteFile();	949	if (file.getAbsolutePath().equals("/..")) { // NOI18N
		950	// Special treatment.
		951	file = new File("/"); // NOI18N
		952	} else {
		953	// URI.normalize removes ../ and ./ sequences nicely.
		954	file = new File(file.toURI().normalize()).getAbsoluteFile();
		955	}
934	}	956	}
935	return file;	957	return file;
936	}	958	}
Lines 1082-1087 Link Here
1082	return index != -1 && index > urlPath.lastIndexOf('/');	1104	return index != -1 && index > urlPath.lastIndexOf('/');
1083	}	1105	}
1084	}	1106	}
		1107
		1108	/**
		1109	* Make sure that a JFileChooser does not traverse symlinks on Unix.
		1110	* @see <a href="http://www.netbeans.org/issues/show_bug.cgi?id=46014">Issue #46014</a>
		1111	* @see <a href="http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=4906607">JRE bug #4906607</a>
		1112	* @since XXX
		1113	*/
		1114	public static void preventFileChooserSymlinkTraversal(JFileChooser jfc) {
		1115	if (!Utilities.isWindows()) {
		1116	jfc.setCurrentDirectory(wrapFileNoCanonicalize(jfc.getCurrentDirectory()));
		1117	jfc.setFileSystemView(new NonCanonicalizingFileSystemView());
		1118	}
		1119	}
1085		1120
		1121	private static File wrapFileNoCanonicalize(File f) {
		1122	if (f instanceof NonCanonicalizingFile) {
		1123	return f;
		1124	} else if (f != null) {
		1125	return new NonCanonicalizingFile(f);
		1126	} else {
		1127	return null;
		1128	}
		1129	}
		1130
		1131	private static File[] wrapFilesNoCanonicalize(File[] fs) {
		1132	if (fs != null) {
		1133	for (int i = 0; i < fs.length; i++) {
		1134	fs[i] = wrapFileNoCanonicalize(fs[i]);
		1135	}
		1136	}
		1137	return fs;
		1138	}
		1139
		1140	private static final class NonCanonicalizingFile extends File {
		1141	public NonCanonicalizingFile(File orig) {
		1142	this(orig.getPath());
		1143	}
		1144	private NonCanonicalizingFile(String path) {
		1145	super(path);
		1146	}
		1147	private NonCanonicalizingFile(URI uri) {
		1148	super(uri);
		1149	}
		1150	public File getCanonicalFile() throws IOException {
		1151	return wrapFileNoCanonicalize(normalizeFile(this));
		1152	}
		1153	public String getCanonicalPath() throws IOException {
		1154	return normalizeFile(this).getAbsolutePath();
		1155	}
		1156	public File getParentFile() {
		1157	return wrapFileNoCanonicalize(super.getParentFile());
		1158	}
		1159	public File getAbsoluteFile() {
		1160	return wrapFileNoCanonicalize(super.getAbsoluteFile());
		1161	}
		1162	public File[] listFiles() {
		1163	return wrapFilesNoCanonicalize(super.listFiles());
		1164	}
		1165	public File[] listFiles(FileFilter filter) {
		1166	return wrapFilesNoCanonicalize(super.listFiles(filter));
		1167	}
		1168	public File[] listFiles(FilenameFilter filter) {
		1169	return wrapFilesNoCanonicalize(super.listFiles(filter));
		1170	}
		1171	}
		1172
		1173	private static final class NonCanonicalizingFileSystemView extends FileSystemView {
		1174	private final FileSystemView delegate = FileSystemView.getFileSystemView();
		1175	public NonCanonicalizingFileSystemView() {}
		1176	public boolean isFloppyDrive(File dir) {
		1177	return delegate.isFloppyDrive(dir);
		1178	}
		1179	public boolean isComputerNode(File dir) {
		1180	return delegate.isComputerNode(dir);
		1181	}
		1182	public File createNewFolder(File containingDir) throws IOException {
		1183	return wrapFileNoCanonicalize(delegate.createNewFolder(containingDir));
		1184	}
1185	public boolean isDrive(File dir) {
1186	return delegate.isDrive(dir);
1187	}
1188	public boolean isFileSystemRoot(File dir) {
1189	return delegate.isFileSystemRoot(dir);
1190	}
1191	public File getHomeDirectory() {
1192	return wrapFileNoCanonicalize(delegate.getHomeDirectory());
1193	}
1194	public File createFileObject(File dir, String filename) {
1195	return wrapFileNoCanonicalize(delegate.createFileObject(dir, filename));
1196	}
1197	public Boolean isTraversable(File f) {
1198	return delegate.isTraversable(f);
1199	}
1200	public boolean isFileSystem(File f) {
1201	return delegate.isFileSystem(f);
1202	}
1203	/*
1204	protected File createFileSystemRoot(File f) {
1205	return translate(delegate.createFileSystemRoot(f));
1206	}
1207	*/
1208	public File getChild(File parent, String fileName) {
1209	return wrapFileNoCanonicalize(delegate.getChild(parent, fileName));
1210	}
1211	public File getParentDirectory(File dir) {
1212	return wrapFileNoCanonicalize(delegate.getParentDirectory(dir));
1213	}
1214	public Icon getSystemIcon(File f) {
1215	return delegate.getSystemIcon(f);
1216	}
1217	public boolean isParent(File folder, File file) {
1218	return delegate.isParent(folder, file);
1219	}
1220	public String getSystemTypeDescription(File f) {
1221	return delegate.getSystemTypeDescription(f);
1222	}
1223	public File getDefaultDirectory() {
1224	return wrapFileNoCanonicalize(delegate.getDefaultDirectory());
1225	}
1226	public String getSystemDisplayName(File f) {
1227	return delegate.getSystemDisplayName(f);
1228	}
1229	public File[] getRoots() {
1230	return wrapFilesNoCanonicalize(delegate.getRoots());
1231	}
1232	public boolean isHiddenFile(File f) {
1233	return delegate.isHiddenFile(f);
1234	}
1235	public File[] getFiles(File dir, boolean useFileHiding) {
1236	return wrapFilesNoCanonicalize(delegate.getFiles(dir, useFileHiding));
1237	}
1238	public boolean isRoot(File f) {
1239	return delegate.isRoot(f);
1240	}
1241	public File createFileObject(String path) {
1242	return wrapFileNoCanonicalize(delegate.createFileObject(path));
1243	}
1244	}
1086		1245
1087	}	1246	}