@Test public void incorrectSkinFile() { Throwable exception = assertThrows(IOException.class, () -> { this.action.getSkinFilePath("../../resources/js/xwiki/xwiki.js", "colibri"); }); assertEquals("Invalid filename: '../../resources/js/xwiki/xwiki.js' for skin 'colibri'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/resources/js/xwiki/xwiki.js] as a skin. " + "Possible break-in attempt!", logCapture.getMessage(0)); exception = assertThrows(IOException.class, () -> { this.action.getSkinFilePath("../../../", "colibri"); }); assertEquals("Invalid filename: '../../../' for skin 'colibri'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/../] as a skin. Possible break-in attempt!", logCapture.getMessage(1)); exception = assertThrows(IOException.class, () -> { this.action.getSkinFilePath("resources/js/xwiki/xwiki.js", ".."); }); assertEquals("Invalid filename: 'resources/js/xwiki/xwiki.js' for skin '..'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/resources/js/xwiki/xwiki.js] as a skin. " + "Possible break-in attempt!", logCapture.getMessage(2)); exception = assertThrows(IOException.class, () -> { this.action.getSkinFilePath("../resources/js/xwiki/xwiki.js", "."); }); assertEquals("Invalid filename: '../resources/js/xwiki/xwiki.js' for skin '.'", exception.getMessage()); assertEquals("Illegal access, tried to use file [/resources/js/xwiki/xwiki.js] as a skin. " + "Possible break-in attempt!", logCapture.getMessage(3)); }
public String getSkinFilePath(String filename, String skin) throws IOException { String path = URI.create(DELIMITER + SKINS_DIRECTORY + DELIMITER + skin + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + SKINS_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a skin. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "' for skin '" + skin + "'"); } return path; }
SkinAction extends XWikiAction { public String getSkinFilePath(String filename, String skin) throws IOException { String path = URI.create(DELIMITER + SKINS_DIRECTORY + DELIMITER + skin + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + SKINS_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a skin. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "' for skin '" + skin + "'"); } return path; } }
SkinAction extends XWikiAction { public String getSkinFilePath(String filename, String skin) throws IOException { String path = URI.create(DELIMITER + SKINS_DIRECTORY + DELIMITER + skin + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + SKINS_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a skin. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "' for skin '" + skin + "'"); } return path; }  }
SkinAction extends XWikiAction { public String getSkinFilePath(String filename, String skin) throws IOException { String path = URI.create(DELIMITER + SKINS_DIRECTORY + DELIMITER + skin + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + SKINS_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a skin. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "' for skin '" + skin + "'"); } return path; }  @Override String render(XWikiContext context); String render(String path, XWikiContext context); String getSkinFilePath(String filename, String skin); String getResourceFilePath(String filename); boolean renderFileFromObjectField(String filename, XWikiDocument doc, final XWikiContext context); boolean renderFileFromAttachment(String filename, XWikiDocument doc, XWikiContext context); boolean isJavascriptMimeType(String mimetype); boolean isCssMimeType(String mimetype); }
SkinAction extends XWikiAction { public String getSkinFilePath(String filename, String skin) throws IOException { String path = URI.create(DELIMITER + SKINS_DIRECTORY + DELIMITER + skin + DELIMITER + filename).normalize().toString(); if (!path.startsWith(DELIMITER + SKINS_DIRECTORY)) { LOGGER.warn("Illegal access, tried to use file [{}] as a skin. Possible break-in attempt!", path); throw new IOException("Invalid filename: '" + filename + "' for skin '" + skin + "'"); } return path; }  @Override String render(XWikiContext context); String render(String path, XWikiContext context); String getSkinFilePath(String filename, String skin); String getResourceFilePath(String filename); boolean renderFileFromObjectField(String filename, XWikiDocument doc, final XWikiContext context); boolean renderFileFromAttachment(String filename, XWikiDocument doc, XWikiContext context); boolean isJavascriptMimeType(String mimetype); boolean isCssMimeType(String mimetype);  }