OpearFile implements Opear { static Result<String[]> validateUriHeaderValues(final @NotNull Manifest manifest, final @NotNull Attributes.Name headerName) { final List<Result<String>> cpResult = Util.getManifestHeaderValues(manifest, headerName.toString()) .stream() .map(result1(URI::new)) .map(uriResult -> uriResult.flatMap(uri -> { final String normal = uri.normalize().getPath().replaceFirst("^/", ""); if ("..".equals(normal) || normal.startsWith("../")) { return Result.failure("Illegal parent path selector in " + normal); } else { return Result.success(normal); } })) .collect(Collectors.toList()); return cpResult.stream() .filter(Result::isFailure).findFirst() .map(failed -> failed.getError() .map(Result::<String[]>failure) .orElseGet(() -> Result.<String[]>failure(format("invalid %s header", headerName)))) .orElseGet(() -> Result.success(cpResult.stream().flatMap(Result::stream).toArray(String[]::new))); } OpearFile(final File cacheDir, final OpearMetadata metadata); @Override URL getDefaultPlan(); @Override Result<URL> getSpecificPlan(final @NotNull String planName); @Override ClassLoader getPlanClassLoader(final @NotNull ClassLoader parent); static Result<OpearFile> fromDirectory(final @NotNull File directory); static Result<OpearFile> fromJar(final @NotNull JarFile jarFile, final @NotNull File cacheBaseDir); static final Attributes.Name NAME_BUNDLE_SYMBOLICNAME; static final Attributes.Name NAME_BUNDLE_VERSION; static final Attributes.Name NAME_CLASS_PATH; static final Attributes.Name NAME_OAKPAL_VERSION; static final Attributes.Name NAME_OAKPAL_PLAN; }
@Test public void testValidateUriHeaderValues() { final Manifest manifest = new Manifest(); manifest.getMainAttributes().put(NAME_CLASS_PATH, "../somedir"); assertTrue(".. should fail", OpearFile.validateUriHeaderValues(manifest, NAME_CLASS_PATH).isFailure()); manifest.getMainAttributes().put(NAME_CLASS_PATH, "/somedir"); assertTrue("/ should succeed", OpearFile.validateUriHeaderValues(manifest, NAME_CLASS_PATH).isSuccess()); manifest.getMainAttributes().put(NAME_CLASS_PATH, "/somedir/../.."); assertTrue("/../.. should fail", OpearFile.validateUriHeaderValues(manifest, NAME_CLASS_PATH).isFailure()); }