axis-java-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From ga...@apache.org
Subject svn commit: r757307 - /webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java
Date Mon, 23 Mar 2009 03:18:33 GMT
Author: gawor
Date: Mon Mar 23 03:18:33 2009
New Revision: 757307

URL: http://svn.apache.org/viewvc?rev=757307&view=rev
Log:
ensure resources can only be loaded from within the directory specified (AXIS2-4282)

Modified:
    webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java

Modified: webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java
URL: http://svn.apache.org/viewvc/webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java?rev=757307&r1=757306&r2=757307&view=diff
==============================================================================
--- webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java
(original)
+++ webservices/axis2/branches/java/1_5/modules/kernel/src/org/apache/axis2/classloader/DirectoryResourceLocation.java
Mon Mar 23 03:18:33 2009
@@ -37,7 +37,7 @@
 
     public ResourceHandle getResourceHandle(String resourceName) {
         File file = new File(baseDir, resourceName);
-        if (!file.exists()) {
+        if (!file.exists() || !isLocal(file)) {
             return null;
         }
 
@@ -49,6 +49,16 @@
         }
     }
 
+    private boolean isLocal(File file) {
+        try {
+            String base = baseDir.getCanonicalPath();
+            String relative = file.getCanonicalPath();
+            return (relative.startsWith(base));
+        } catch (IOException e) {
+            return false;
+        }
+    }
+    
     public Manifest getManifest() throws IOException {
         if (!manifestLoaded) {
             File manifestFile = new File(baseDir, "META-INF/MANIFEST.MF");



Mime
View raw message