You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@archiva.apache.org by ma...@apache.org on 2019/03/02 23:12:02 UTC
[archiva] 02/03: Adding additional verifications for upload
This is an automated email from the ASF dual-hosted git repository.
martin_s pushed a commit to branch archiva-2.x
in repository https://gitbox.apache.org/repos/asf/archiva.git
commit cc0d8ad0b525e641855319812877fdc6c8cd327c
Author: Martin Stockhammer <ma...@apache.org>
AuthorDate: Sun Mar 3 00:10:49 2019 +0100
Adding additional verifications for upload
---
.../archiva/web/api/DefaultFileUploadService.java | 29 +++++++++++++++++++---
1 file changed, 25 insertions(+), 4 deletions(-)
diff --git a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java
index 4fd8f68..7119986 100644
--- a/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java
+++ b/archiva-modules/archiva-web/archiva-web-common/src/main/java/org/apache/archiva/web/api/DefaultFileUploadService.java
@@ -69,6 +69,7 @@ import java.io.File;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
+import java.net.URLDecoder;
import java.nio.file.*;
import java.text.DateFormat;
import java.text.SimpleDateFormat;
@@ -115,7 +116,8 @@ public class DefaultFileUploadService
throws IOException
{
Attachment attachment = multipartBody.getAttachment( attachmentId );
- return attachment == null ? "" : IOUtils.toString( attachment.getDataHandler().getInputStream() );
+ return attachment == null ? "" :
+ StringUtils.trim(URLDecoder.decode(IOUtils.toString( attachment.getDataHandler().getInputStream() ), "UTF-8"));
}
@Override
@@ -128,9 +130,26 @@ public class DefaultFileUploadService
String classifier = getStringValue( multipartBody, "classifier" );
String packaging = getStringValue( multipartBody, "packaging" );
+
+ checkParamChars( "classifier", classifier );
+ checkParamChars( "packaging", packaging);
+
// skygo: http header form pomFile was once sending 1 for true and void for false
// leading to permanent false value for pomFile if using toBoolean(); use , "1", ""
- boolean pomFile = BooleanUtils.toBoolean( getStringValue( multipartBody, "pomFile" ) );
+
+ boolean pomFile = false;
+ try
+ {
+ pomFile = BooleanUtils.toBoolean( getStringValue( multipartBody, "pomFile" ) );
+ }
+ catch ( IllegalArgumentException ex )
+ {
+ ArchivaRestServiceException e = new ArchivaRestServiceException("Bad value for boolean pomFile field.", null);
+ e.setHttpErrorCode(422);
+ e.setFieldName( "pomFile" );
+ e.setErrorKey("fileupload.malformed.pomFile");
+ throw e;
+ }
Attachment file = multipartBody.getAttachment( "files[]" );
@@ -141,7 +160,7 @@ public class DefaultFileUploadService
ArchivaRestServiceException e = new ArchivaRestServiceException("Bad filename in upload content: " + fileName + " - File traversal chars (..|/) are not allowed"
, null);
e.setHttpErrorCode(422);
- e.setErrorKey("error.upload.malformed.filename");
+ e.setErrorKey("fileupload.malformed.filename");
throw e;
}
@@ -249,7 +268,7 @@ public class DefaultFileUploadService
if (!hasValidChars(value)) {
ArchivaRestServiceException e = new ArchivaRestServiceException("Bad characters in " + param, null);
e.setHttpErrorCode(422);
- e.setErrorKey("error.upload.malformed.param." + param);
+ e.setErrorKey("fileupload.malformed.param");
e.setFieldName(param);
throw e;
}
@@ -269,8 +288,10 @@ public class DefaultFileUploadService
checkParamChars("repositoryId", repositoryId);
checkParamChars("groupId", groupId);
checkParamChars("artifactId", artifactId);
+ checkParamChars( "version", version);
checkParamChars("packaging", packaging);
+
List<FileMetadata> fileMetadatas = getSessionFilesList();
if ( fileMetadatas == null || fileMetadatas.isEmpty() )
{