[jira] [Commented] (VFS-733) Parent layer of ZipFileSystem set to null through OnCallRefreshFileObject

["Bruno P. Kinoshita (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/VFS-733?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16945554#comment-16945554 ] 

Bruno P. Kinoshita commented on VFS-733:
----------------------------------------

Don't know the component and its codebase well enough to have a good opinion on whether it's safe to remove it or not. But at least looking at the git blame with GitHub's interface, it doesn't seem to have been added to fix a security bug.

[https://github.com/apache/commons-vfs/commit/5e5a5eaeba244bde97283135ee3f6d1730850563]

The commit message seems to be related to GC collection for soft references. But given other class attributes are not set to null, maybe it that line where parentLayer is set to null could be removed. I wonder if it could also be made a `private final FileObject` as the `rootName`?

 

> Parent layer of ZipFileSystem set to null through OnCallRefreshFileObject
> -------------------------------------------------------------------------
>
>                 Key: VFS-733
>                 URL: https://issues.apache.org/jira/browse/VFS-733
>             Project: Commons VFS
>          Issue Type: Bug
>    Affects Versions: 2.2, 2.4, 2.3, 2.4.1
>            Reporter: Falco
>            Priority: Major
>
> When using {{FileObject#exists}} and {{FileObject#getContent}} on a ZIP file (in any order), the reference to the parent file system is set to {{null}}.
> {code}
> final FileObject zippedFile = new OnCallRefreshFileObject(fileInZip());
> assertNotNull(zippedFile.getFileSystem().getParentLayer());
> zippedFile.exists();
> zippedFile.getContent();
> assertNotNull(zippedFile.getFileSystem().getParentLayer()); // fails
> {code}
> For an executable example, refer to [https://github.com/f4lco/vfs-repro/blob/master/src/test/java/vfs/ZipParentLayerTest.java].
> I come to believe this does not work as intended. I'm also relatively clueless about a potential fix or workaround. For me, this bug blocks upgrading from VFS 2.1.



--
This message was sent by Atlassian Jira
(v8.3.4#803005)