Apache
/
archiva
mirror of https://github.com/apache/archiva.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adding additional verifications for upload 

(cherry picked from commit cc0d8ad0b5)
This commit is contained in:
Martin Stockhammer 2019-03-03 00:10:49 +01:00
parent 05e1c462af
commit 4fe9a38bea
1 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java
View File

@ -68,6 +68,7 @@ import javax.ws.rs.core.Response;
import java.io.FileOutputStream; import java.io.FileOutputStream;
import java.io.FileWriter; import java.io.FileWriter;
import java.io.IOException; import java.io.IOException;
import java.net.URLDecoder;
import java.nio.file.*; import java.nio.file.*;
import java.text.DateFormat; import java.text.DateFormat;
import java.text.SimpleDateFormat; import java.text.SimpleDateFormat;
@ -115,7 +116,8 @@ public class DefaultFileUploadService
throws IOException throws IOException
{ {
Attachment attachment = multipartBody.getAttachment( attachmentId ); Attachment attachment = multipartBody.getAttachment( attachmentId );
return attachment == null ? "" : IOUtils.toString( attachment.getDataHandler().getInputStream(), "UTF-8" ); return attachment == null ? "" :
StringUtils.trim(URLDecoder.decode(IOUtils.toString( attachment.getDataHandler().getInputStream(), "UTF-8" ), "UTF-8"));
} }
@Override @Override
@ -128,9 +130,26 @@ public class DefaultFileUploadService
String classifier = getStringValue( multipartBody, "classifier" ); String classifier = getStringValue( multipartBody, "classifier" );
String packaging = getStringValue( multipartBody, "packaging" ); String packaging = getStringValue( multipartBody, "packaging" );
checkParamChars( "classifier", classifier );
checkParamChars( "packaging", packaging);
// skygo: http header form pomFile was once sending 1 for true and void for false // skygo: http header form pomFile was once sending 1 for true and void for false
// leading to permanent false value for pomFile if using toBoolean(); use , "1", "" // leading to permanent false value for pomFile if using toBoolean(); use , "1", ""
boolean pomFile = BooleanUtils.toBoolean( getStringValue( multipartBody, "pomFile" ) );
boolean pomFile = false;
try
{
pomFile = BooleanUtils.toBoolean( getStringValue( multipartBody, "pomFile" ) );
}
catch ( IllegalArgumentException ex )
{
ArchivaRestServiceException e = new ArchivaRestServiceException("Bad value for boolean pomFile field.", null);
e.setHttpErrorCode(422);
e.setFieldName( "pomFile" );
e.setErrorKey("fileupload.malformed.pomFile");
throw e;
}
Attachment file = multipartBody.getAttachment( "files[]" ); Attachment file = multipartBody.getAttachment( "files[]" );
@ -141,7 +160,7 @@ public class DefaultFileUploadService
ArchivaRestServiceException e = new ArchivaRestServiceException("Bad filename in upload content: " + fileName + " - File traversal chars (..|/) are not allowed" ArchivaRestServiceException e = new ArchivaRestServiceException("Bad filename in upload content: " + fileName + " - File traversal chars (..|/) are not allowed"
, null); , null);
e.setHttpErrorCode(422); e.setHttpErrorCode(422);
e.setErrorKey("error.upload.malformed.filename"); e.setErrorKey("fileupload.malformed.filename");
throw e; throw e;
} }
@ -252,7 +271,7 @@ public class DefaultFileUploadService
if (!hasValidChars(value)) { if (!hasValidChars(value)) {
ArchivaRestServiceException e = new ArchivaRestServiceException("Bad characters in " + param, null); ArchivaRestServiceException e = new ArchivaRestServiceException("Bad characters in " + param, null);
e.setHttpErrorCode(422); e.setHttpErrorCode(422);
e.setErrorKey("error.upload.malformed.param." + param); e.setErrorKey("fileupload.malformed.param");
e.setFieldName(param); e.setFieldName(param);
throw e; throw e;
} }
@ -272,8 +291,10 @@ public class DefaultFileUploadService
checkParamChars("repositoryId", repositoryId); checkParamChars("repositoryId", repositoryId);
checkParamChars("groupId", groupId); checkParamChars("groupId", groupId);
checkParamChars("artifactId", artifactId); checkParamChars("artifactId", artifactId);
checkParamChars( "version", version);
checkParamChars("packaging", packaging); checkParamChars("packaging", packaging);
List<FileMetadata> fileMetadatas = getSessionFilesList(); List<FileMetadata> fileMetadatas = getSessionFilesList();
if ( fileMetadatas == null || fileMetadatas.isEmpty() ) if ( fileMetadatas == null || fileMetadatas.isEmpty() )
{ {