Improved: Fix some bugs Spotbugs reports
In SecuredUpload::isValidFile fixes a possible null dereferencement
@@ -114,9 +114,9 @@ public class SecuredUpload {
String imageServerUrl = EntityUtilProperties.getPropertyValue("catalog", "image.management.url", delegator);
Path p = Paths.get(fileToCheck);
- String fileName = p.getFileName().toString(); // The file name is the farthest element from the root in the directory hierarchy.
boolean wrongFile = true;
-
+ if (p != null) {
+ String fileName = p.getFileName().toString(); // The file name is the farthest element from the root in the directory hierarchy.
if (DENIEDFILEEXTENSIONS.contains(FilenameUtils.getExtension(fileToCheck))) {
Debug.logError("This file extension is not allowed for security reason", MODULE);
deleteBadFile(fileToCheck);
@@ -124,7 +124,8 @@ public class SecuredUpload {
}
if (org.apache.commons.lang3.SystemUtils.IS_OS_WINDOWS) {
- if (fileToCheck.length() > 259) { // More about that: https://docs.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation
+ // More about that: https://docs.microsoft.com/en-us/windows/win32/fileio/maximum-file-path-limitation
+ if (fileToCheck.length() > 259) {
Debug.logError("Uploaded file name too long", MODULE);
} else if (p.toString().contains(imageServerUrl.replaceAll("/", "\\\\"))) {
if (fileName.matches("[a-zA-Z0-9-_ ()]{1,249}.[a-zA-Z0-9-_ ]{1,10}")) { // "(" and ")" for duplicates files
@@ -144,6 +145,7 @@ public class SecuredUpload {
wrongFile = false;
}
}
+ }
if (wrongFile) {
Debug.logError("Uploaded file "
