diff --git a/solr/core/src/test/org/apache/solr/util/TestSystemIdResolver.java b/solr/core/src/test/org/apache/solr/util/TestSystemIdResolver.java index 4c2677df690..f87eeb47cf1 100644 --- a/solr/core/src/test/org/apache/solr/util/TestSystemIdResolver.java +++ b/solr/core/src/test/org/apache/solr/util/TestSystemIdResolver.java @@ -19,6 +19,7 @@ package org.apache.solr.util; import java.io.File; import java.io.IOException; import java.nio.file.Path; +import java.util.Arrays; import org.apache.commons.io.IOUtils; import org.apache.lucene.analysis.util.ResourceLoader; @@ -29,11 +30,6 @@ import org.xml.sax.InputSource; public class TestSystemIdResolver extends LuceneTestCase { - public void setUp() throws Exception { - super.setUp(); - System.setProperty("solr.allow.unsafe.resourceloading", "true"); - } - public void tearDown() throws Exception { System.clearProperty("solr.allow.unsafe.resourceloading"); super.tearDown(); @@ -74,8 +70,6 @@ public class TestSystemIdResolver extends LuceneTestCase { "solrres:/org/apache/solr/util/RTimer.class", "TestSystemIdResolver.class"); assertEntityResolving(resolver, SystemIdResolver.createSystemIdFromResourceName(testHome+"/collection1/conf/schema.xml"), SystemIdResolver.createSystemIdFromResourceName(testHome+"/collection1/conf/solrconfig.xml"), "schema.xml"); - assertEntityResolving(resolver, SystemIdResolver.createSystemIdFromResourceName(testHome+"/crazy-path-to-schema.xml"), - SystemIdResolver.createSystemIdFromResourceName(testHome+"/crazy-path-to-config.xml"), "crazy-path-to-schema.xml"); // if somebody uses an absolute uri (e.g., file://) we should fail resolving: IOException ioe = expectThrows(IOException.class, () -> { @@ -89,10 +83,24 @@ public class TestSystemIdResolver extends LuceneTestCase { assertTrue(ioe.getMessage().startsWith("Cannot resolve absolute")); // check that we can't escape with absolute file paths: - ioe = expectThrows(IOException.class, () -> { - resolver.resolveEntity(null, null, "solrres:/solrconfig.xml", "/etc/passwd"); - }); - assertTrue(ioe.getMessage().startsWith("Can't find resource '/etc/passwd' in classpath or")); + for (String path : Arrays.asList("/etc/passwd", "/windows/notepad.exe")) { + ioe = expectThrows(IOException.class, () -> { + resolver.resolveEntity(null, null, "solrres:/solrconfig.xml", path); + }); + assertTrue(ioe.getMessage().startsWith("Can't find resource") + || ioe.getMessage().contains("is outside resource loader dir")); + } + } + + public void testUnsafeResolving() throws Exception { + System.setProperty("solr.allow.unsafe.resourceloading", "true"); + + final Path testHome = SolrTestCaseJ4.getFile("solr/collection1").getParentFile().toPath(); + final ResourceLoader loader = new SolrResourceLoader(testHome.resolve("collection1"), this.getClass().getClassLoader()); + final SystemIdResolver resolver = new SystemIdResolver(loader); + + assertEntityResolving(resolver, SystemIdResolver.createSystemIdFromResourceName(testHome+"/crazy-path-to-schema.xml"), + SystemIdResolver.createSystemIdFromResourceName(testHome+"/crazy-path-to-config.xml"), "crazy-path-to-schema.xml"); } }