svn commit: r1124788 - in /tika/trunk/tika-core/src/main/java/org/apache/tika: io/TikaInputStream.java sax/SecureContentHandler.java

[ju...@apache.org]

Author: jukka
Date: Thu May 19 13:58:08 2011
New Revision: 1124788

URL: http://svn.apache.org/viewvc?rev=1124788&view=rev
Log:
TIKA-645: Parsers can't get at an underlying TikaInputStream to get the file if they wanted one

Use the file length for Zip bomb prevention in case the parser is using the file directly instead of reading from the stream.

Modified:
    tika/trunk/tika-core/src/main/java/org/apache/tika/io/TikaInputStream.java
    tika/trunk/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java

Modified: tika/trunk/tika-core/src/main/java/org/apache/tika/io/TikaInputStream.java
URL: http://svn.apache.org/viewvc/tika/trunk/tika-core/src/main/java/org/apache/tika/io/TikaInputStream.java?rev=1124788&r1=1124787&r2=1124788&view=diff
==============================================================================
--- tika/trunk/tika-core/src/main/java/org/apache/tika/io/TikaInputStream.java (original)
+++ tika/trunk/tika-core/src/main/java/org/apache/tika/io/TikaInputStream.java Thu May 19 13:58:08 2011
@@ -512,6 +512,7 @@ public class TikaInputStream extends Tag
                 in.close();
                 // Re-point the stream at the file now we have it
                 in = new BufferedInputStream(new FileInputStream(file));
+                length = file.length();
             }
         }
         return file;

Modified: tika/trunk/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java
URL: http://svn.apache.org/viewvc/tika/trunk/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java?rev=1124788&r1=1124787&r2=1124788&view=diff
==============================================================================
--- tika/trunk/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java (original)
+++ tika/trunk/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java Thu May 19 13:58:08 2011
@@ -16,6 +16,8 @@
  */
 package org.apache.tika.sax;
 
+import java.io.IOException;
+
 import org.apache.tika.exception.TikaException;
 import org.apache.tika.io.TikaInputStream;
 import org.xml.sax.ContentHandler;
@@ -129,6 +131,18 @@ public class SecureContentHandler extend
         }
     }
 
+    private long getByteCount() throws SAXException {
+        try {
+            if (stream.hasLength()) {
+                return stream.getLength();
+            } else {
+                return stream.getPosition();
+            }
+        } catch (IOException e) {
+            throw new SAXException("Unable to get stream length", e);
+        }
+    }
+
     /**
      * Records the given number of output characters (or more accurately
      * UTF-16 code units). Throws an exception if the recorded number of
@@ -139,9 +153,10 @@ public class SecureContentHandler extend
      */
     private void advance(int length) throws SAXException {
         characterCount += length;
+        long byteCount = getByteCount();
         if (characterCount > threshold
-                && characterCount > stream.getPosition() * ratio) {
-            throw new SecureSAXException();
+                && characterCount > byteCount * ratio) {
+            throw new SecureSAXException(byteCount);
         }
     }
 
@@ -166,9 +181,9 @@ public class SecureContentHandler extend
      */
     private class SecureSAXException extends SAXException {
 
-        public SecureSAXException() {
+        public SecureSAXException(long byteCount) throws SAXException {
             super("Suspected zip bomb: "
-                    + stream.getPosition() + " input bytes produced "
+                    + byteCount + " input bytes produced "
                     + characterCount + " output characters");
         }