@Test public void incorrectResourceFile() { Throwable exception = assertThrows(IOException.class, () -> { this.action.getResourceFilePath("../../skins/js/xwiki/xwiki.js"); }); assertEquals("Invalid filename: '../../skins/js/xwiki/xwiki.js'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/../skins/js/xwiki/xwiki.js] as a resource. " + "Possible break-in attempt!", logCapture.getMessage(0)); exception = assertThrows(IOException.class, () -> { this.action.getResourceFilePath("../../../"); }); assertEquals("Invalid filename: '../../../'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/../../] as a resource. Possible break-in attempt!", logCapture.getMessage(1)); exception = assertThrows(IOException.class, () -> { this.action.getResourceFilePath("../../redirect"); }); assertEquals("Invalid filename: '../../redirect'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/../redirect] as a resource. Possible break-in attempt!", logCapture.getMessage(2)); }
public String getResourceFilePath(String filename) throws IOException { String path = URI.create(DELIMITER + RESOURCES_DIRECTORY + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + RESOURCES_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a resource. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "'"); } return path; }
SkinAction extends XWikiAction { public String getResourceFilePath(String filename) throws IOException { String path = URI.create(DELIMITER + RESOURCES_DIRECTORY + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + RESOURCES_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a resource. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "'"); } return path; } }
SkinAction extends XWikiAction { public String getResourceFilePath(String filename) throws IOException { String path = URI.create(DELIMITER + RESOURCES_DIRECTORY + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + RESOURCES_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a resource. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "'"); } return path; }  }
SkinAction extends XWikiAction { public String getResourceFilePath(String filename) throws IOException { String path = URI.create(DELIMITER + RESOURCES_DIRECTORY + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + RESOURCES_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a resource. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "'"); } return path; }  @Override String render(XWikiContext context); String render(String path, XWikiContext context); String getSkinFilePath(String filename, String skin); String getResourceFilePath(String filename); boolean renderFileFromObjectField(String filename, XWikiDocument doc, final XWikiContext context); boolean renderFileFromAttachment(String filename, XWikiDocument doc, XWikiContext context); boolean isJavascriptMimeType(String mimetype); boolean isCssMimeType(String mimetype); }
SkinAction extends XWikiAction { public String getResourceFilePath(String filename) throws IOException { String path = URI.create(DELIMITER + RESOURCES_DIRECTORY + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + RESOURCES_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a resource. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "'"); } return path; }  @Override String render(XWikiContext context); String render(String path, XWikiContext context); String getSkinFilePath(String filename, String skin); String getResourceFilePath(String filename); boolean renderFileFromObjectField(String filename, XWikiDocument doc, final XWikiContext context); boolean renderFileFromAttachment(String filename, XWikiDocument doc, XWikiContext context); boolean isJavascriptMimeType(String mimetype); boolean isCssMimeType(String mimetype);  }