You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@felix.apache.org by "pigelvy (via GitHub)" <gi...@apache.org> on 2026/05/06 12:58:00 UTC
[PR] Fix an issue where SecureAction#getCanonicalPath can resolve paths to real paths [felix-dev]
pigelvy opened a new pull request, #501:
URL: https://github.com/apache/felix-dev/pull/501
On Windows, if Apache Felix is run from a `subst` drive (e.g. "`P:\felix`" where "P:" is a "`subst`" drive to "`C:\tmp`"), some internal resources failed to be properly resolved on startup.
I noticed that, with Java 25, an exception occured in `org.apache.felix.framework.Felix#handleJavaVersionChange()`.
```
ERROR: Bundle org.apache.felix.framework [0] The data file must be inside the data dir. Could not create framework: java.lang.NullPointerException: Cannot invoke "java.io.File.isFile()" because "dataFile" is null java.lang.NullPointerException: Cannot invoke "java.io.File.isFile()" because "dataFile" is null
at org.apache.felix.framework.Felix.handleJavaVersionChange(Felix.java:1012)
at org.apache.felix.framework.Felix.init(Felix.java:810)
at org.apache.felix.framework.Felix.init(Felix.java:648)
at org.apache.felix.main.Main.main(Main.java:289)
```
After some investigation and step-by-step debugging, it appeared that the issue is located in `BundleCache#getSystemBundleDataFile(String)` because the canonical paths are not resolved similarly. This causes the file to be detected as outside of it directory.
```
String dataFilePath = BundleCache.getSecureAction().getCanonicalPath(dataFile);
String dataDirPath = BundleCache.getSecureAction().getCanonicalPath(sbDir);
if (!dataFilePath.equals(dataDirPath) && !dataFilePath.startsWith(dataDirPath + File.separatorChar))
{
throw new IllegalArgumentException("The data file must be inside the data dir.");
}
```
To prevent this verification from being too dependent on the underlying file-system and the resolution to real paths, this commit leverages `java.nio.file.Path#normalize` to sanitize the file path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix an issue where SecureAction#getCanonicalPath can resolve paths to real paths [felix-dev]
Posted by "pigelvy (via GitHub)" <gi...@apache.org>.
pigelvy commented on PR #501:
URL: https://github.com/apache/felix-dev/pull/501#issuecomment-4475551930
Even though the SecurityManager is about to be removed, I added a second commit to also change the canonical path resolutioin when the SecurityManager is active.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix an issue where SecureAction#getCanonicalPath can resolve paths to real paths [felix-dev]
Posted by "stbischof (via GitHub)" <gi...@apache.org>.
stbischof commented on PR #501:
URL: https://github.com/apache/felix-dev/pull/501#issuecomment-4488364393
yes. i can take it. and add tck befor we do such changes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix an issue where SecureAction#getCanonicalPath can resolve paths to real paths [felix-dev]
Posted by "pigelvy (via GitHub)" <gi...@apache.org>.
pigelvy commented on PR #501:
URL: https://github.com/apache/felix-dev/pull/501#issuecomment-4484917454
So, there are CI execution failure because of some missing Maven dependency: [build (23) - OSGi CTK Framework](https://github.com/apache/felix-dev/actions/runs/26019323660/job/76587408296?pr=501#step:13:216)
Can somebody have a look at this missing dependency?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Fix an issue where SecureAction#getCanonicalPath can resolve paths to real paths [felix-dev]
Posted by "paulrutter (via GitHub)" <gi...@apache.org>.
paulrutter commented on PR #501:
URL: https://github.com/apache/felix-dev/pull/501#issuecomment-4485313894
> So, there are CI execution failure because of some missing Maven dependency: [build (23) - OSGi CTK Framework](https://github.com/apache/felix-dev/actions/runs/26019323660/job/76587408296?pr=501#step:13:216)
>
> Can somebody have a look at this missing dependency?
@stbischof you might know as you added the TCK
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@felix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org