Skip to content

Conversation

syjer
Copy link
Member

@syjer syjer commented Jun 30, 2024

with a configurable "directory", used by file upload, font and images for passkit.

@syjer syjer requested a review from cbellone June 30, 2024 18:51
public File getFile(String section, String id, Supplier<File> supplier) {
var resourcePath = getBlobDir(section).resolve(id);
checkPath(resourcePath, section);
if (Files.exists(resourcePath)) {

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
var dir = getBlobDir(section);
try {
Files.createDirectories(dir);
Files.move(tmpFile.toPath(), resourcePath, StandardCopyOption.ATOMIC_MOVE);

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
Files.move(tmpFile.toPath(), resourcePath, StandardCopyOption.ATOMIC_MOVE);
return Files.newInputStream(resourcePath); // second try...
}
return new FileInputStream(fileBlobCacheManager.getFile(FILE_SECTION, id, () -> repository.file(id)));

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).


public FileBlobCacheManager(Environment environment) {
this.cacheDir = Optional.ofNullable(environment.getProperty("alfio.cache-dir")).orElse(System.getProperty("java.io.tmpdir"));
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fixed

if (Files.exists(resourcePath)) {
return resourcePath.toFile();
}
log.info("Cache not hit for file {}", id);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better log cache miss at DEBUG or TRACE level?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated to debug

public File getFile(String section, String id, Supplier<File> supplier) {
var resourcePath = getBlobDir(section).resolve(id);
checkPath(resourcePath, section);
if (Files.exists(resourcePath)) {

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1).
Copy link

@cbellone cbellone merged commit 727daa9 into main Jul 12, 2024
@syjer syjer deleted the fileblob-cache branch September 26, 2024 09:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants