RawUploadHandlerSupport extends UploadHandlerSupport { @Override public UploadResponse handle(final Repository repository, final ComponentUpload upload) throws IOException { String basePath = upload.getFields().get(DIRECTORY).trim(); Map<String,PartPayload> pathToPayload = new LinkedHashMap<>(); for (AssetUpload asset : upload.getAssetUploads()) { String path = normalizePath(basePath + '/' + asset.getFields().get(FILENAME).trim()); ensurePermitted(repository.getName(), RawFormat.NAME, path, emptyMap()); pathToPayload.put(path, asset.getPayload()); } List<Content> responseContents = getResponseContents(repository, pathToPayload); return new UploadResponse(responseContents, new ArrayList<>(pathToPayload.keySet())); } RawUploadHandlerSupport(
      final ContentPermissionChecker contentPermissionChecker,
      final VariableResolverAdapter variableResolverAdapter,
      final Set<UploadDefinitionExtension> uploadDefinitionExtensions); @Override UploadResponse handle(final Repository repository, final ComponentUpload upload); @Override Content handle(
      final Repository repository,
      final File content,
      final String path); @Override UploadDefinition getDefinition(); @Override VariableResolverAdapter getVariableResolverAdapter(); @Override ContentPermissionChecker contentPermissionChecker(); @Override boolean supportsExportImport();  }
@Test public void testHandle_unauthorized() throws IOException { when(contentPermissionChecker.isPermitted(eq(REPO_NAME), eq(RawFormat.NAME), eq(BreadActions.EDIT), any())) .thenReturn(false); ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "org/apache/maven"); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "foo.jar"); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); asset = new AssetUpload(); asset.getFields().put("filename", "bar.jar"); asset.setPayload(sourcesPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Not authorized for requested path '" + path("org/apache/maven/foo.jar") + "'")); } }
@Test public void testHandle_dotDirectory() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "."); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "foo.jar"); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("./foo.jar") + "'")); } }
@Test public void testHandle_doubleDotDirectory() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", ".."); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "foo.jar"); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("../foo.jar") + "'")); } }
@Test public void testHandle_convertDoubleDotDirectory() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "foo/.."); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "foo.jar"); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("foo/../foo.jar") + "'")); } }
@Test public void testHandle_dotFilename() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "foo"); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "."); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("foo/.") + "'")); } }
@Test public void testHandle_doubleDotFilename() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "foo"); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", ".."); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("foo/..") + "'")); } }
@Test public void testHandle_covertDoubleDotFilename() throws IOException { ComponentUpload component = new ComponentUpload(); component.getFields().put("directory", "foo"); AssetUpload asset = new AssetUpload(); asset.getFields().put("filename", "foo/../../foo.jar"); asset.setPayload(jarPayload); component.getAssetUploads().add(asset); try { underTest.handle(repository, component); fail("Expected validation exception"); } catch (ValidationErrorsException e) { assertThat(e.getValidationErrors().size(), is(1)); assertThat(e.getValidationErrors().get(0).getMessage(), is("Path is not allowed to have '.' or '..' segments: '" + path("foo/foo/../../foo.jar") + "'")); } }