FileUploader implements FileUploaderMBean { @Override public void deleteFiles(List<String> files) { if (files == null || files.isEmpty()) { return; } for (String filename : files) { File file = new File(filename); File parent = file.getParentFile(); if (!parent.getName().startsWith(STAGED_DIR_PREFIX)) { throw new GemFireSecurityException( String.format("Cannot delete %s, not in the uploaded directory.", filename)); } FileUtils.deleteQuietly(file); FileUtils.deleteQuietly(parent); } } FileUploader(RemoteStreamExporter exporter); @Override RemoteFile uploadFile(String filename); @Override void deleteFiles(List<String> files); static Path createSecuredTempDirectory(String prefix); static final String STAGED_DIR_PREFIX; }
@Test public void deleteFileNotInTheUploadedDir() throws IOException { File file = temporaryFolder.newFile("a.jar"); files.add(file.getAbsolutePath()); assertThatThrownBy(() -> fileUploader.deleteFiles(files)) .isInstanceOf(GemFireSecurityException.class); }
@Test public void deleteFilesInUploadedDir() throws IOException { File dir = temporaryFolder.newFolder(FileUploader.STAGED_DIR_PREFIX + "test"); File file = new File(dir, "test.txt"); FileUtils.writeStringToFile(file, "test", "UTF-8"); assertThat(file).exists(); files.add(file.getAbsolutePath()); fileUploader.deleteFiles(files); assertThat(file).doesNotExist(); assertThat(dir).doesNotExist(); }