Mercurial > hg > release > icedtea7-forest-2.6 > jdk
changeset 9900:82f3382912e9
8235909: File.exists throws AccessControlException for invalid paths when a SecurityManager is installed
Summary: Backport of JDK-8213429 missed handling the "<<ALL FILES>>" special case
Reviewed-by: mbalao
author | andrew |
---|---|
date | Mon, 03 Feb 2020 06:54:40 +0000 |
parents | c993dcb8b6c6 |
children | f87a938560e4 |
files | src/share/classes/java/io/FilePermission.java |
diffstat | 1 files changed, 36 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/src/share/classes/java/io/FilePermission.java Mon Nov 18 17:00:23 2013 +0400 +++ b/src/share/classes/java/io/FilePermission.java Mon Feb 03 06:54:40 2020 +0000 @@ -46,8 +46,11 @@ * the file separator character, <code>File.separatorChar</code>) indicates * all the files and directories contained in that directory. A pathname * that ends with "/-" indicates (recursively) all files - * and subdirectories contained in that directory. A pathname consisting of - * the special token "<<ALL FILES>>" matches <b>any</b> file. + * and subdirectories contained in that directory. Such a pathname is called + * a wildcard pathname. Otherwise, it's a simple pathname. + * <P> + * A pathname consisting of the special token {@literal "<<ALL FILES>>"} + * matches <b>any</b> file. * <P> * Note: A pathname consisting of a single "*" indicates all the files * in the current directory, while a pathname consisting of a single "-" @@ -80,7 +83,7 @@ * <P> * Be careful when granting FilePermissions. Think about the implications * of granting read and especially write access to various files and - * directories. The "<<ALL FILES>>" permission with write action is + * directories. The {@literal "<<ALL FILES>>"} permission with write action is * especially dangerous. This grants permission to write to the entire * file system. One thing this effectively allows is replacement of the * system binary, including the JVM runtime environment. @@ -156,6 +159,7 @@ private transient String cpath; + private transient boolean allFiles; // whether this is <<ALL FILES>> private transient boolean invalid; // whether input path is invalid // static Strings used by init(int mask) @@ -209,6 +213,7 @@ this.mask = mask; if (cpath.equals("<<ALL FILES>>")) { + allFiles = true; directory = true; recursive = true; cpath = ""; @@ -340,6 +345,23 @@ * "/tmp/*" encompasses all files in the "/tmp" directory, * including the one named "foo". * </ul> + * <P> + * Precisely, a simple pathname implies another simple pathname + * if and only if they are equal. A simple pathname never implies + * a wildcard pathname. A wildcard pathname implies another wildcard + * pathname if and only if all simple pathnames implied by the latter + * are implied by the former. A wildcard pathname implies a simple + * pathname if and only if + * <ul> + * <li>if the wildcard flag is "*", the simple pathname's path + * must be right inside the wildcard pathname's path. + * <li>if the wildcard flag is "-", the simple pathname's path + * must be recursively inside the wildcard pathname's path. + * </ul> + * <P> + * {@literal "<<ALL FILES>>"} implies every other pathname. No pathname, + * except for {@literal "<<ALL FILES>>"} itself, implies + * {@literal "<<ALL FILES>>"}. * * @param p the permission to check against. * @@ -372,9 +394,15 @@ if (this == that) { return true; } + if (allFiles) { + return true; + } if (this.invalid || that.invalid) { return false; } + if (that.allFiles) { + return false; + } if (this.directory) { if (this.recursive) { // make sure that.path is longer then path so @@ -421,6 +449,10 @@ * Checks two FilePermission objects for equality. Checks that <i>obj</i> is * a FilePermission, and has the same pathname and actions as this object. * + * @implNote More specifically, two pathnames are the same if and only if + * they have the same wildcard flag and their + * {@code npath} are equal. Or they are both {@literal "<<ALL FILES>>"}. + * * @param obj the object we are testing for equality with this object. * @return <code>true</code> if obj is a FilePermission, and has the same * pathname and actions as this FilePermission object, @@ -439,6 +471,7 @@ return false; } return (this.mask == that.mask) && + (this.allFiles == that.allFiles) && this.cpath.equals(that.cpath) && (this.directory == that.directory) && (this.recursive == that.recursive);