org.dspace.app.xmlui.cocoon

Class SafeResourceReader

java.lang.Object

org.apache.cocoon.util.AbstractLogEnabled

org.apache.cocoon.reading.AbstractReader

org.apache.cocoon.reading.ResourceReader

org.dspace.app.xmlui.cocoon.SafeResourceReader

All Implemented Interfaces:

org.apache.avalon.excalibur.pool.Poolable, org.apache.avalon.excalibur.pool.Recyclable, org.apache.avalon.framework.configuration.Configurable, org.apache.cocoon.caching.CacheableProcessingComponent, org.apache.cocoon.reading.Reader, org.apache.cocoon.sitemap.SitemapModelComponent, org.apache.cocoon.sitemap.SitemapOutputComponent

Direct Known Subclasses:

ThemeResourceReader

public class SafeResourceReader
extends org.apache.cocoon.reading.ResourceReader
implements org.apache.cocoon.caching.CacheableProcessingComponent, org.apache.avalon.framework.configuration.Configurable

The SafeResourceReader blocks access to specific paths which we do NOT want to be readable on the web. By default, the Cocoon ResourceReader just loads whatever local file you request, which is not very secure and exposes XMLUI to possible directory traversal vulnerabilities (when encoded dots or slashes are passed on the URL).

Field Summary

Fields inherited from class org.apache.cocoon.reading.ResourceReader

bufferSize, byteRanges, configuredBufferSize, configuredByteRanges, configuredExpires, configuredQuickTest, expires, inputSource, quickTest, request, response

Fields inherited from class org.apache.cocoon.reading.AbstractReader

objectModel, out, parameters, resolver, source

Fields inherited from interface org.apache.cocoon.reading.Reader

ROLE

Constructor Summary

Constructors

Constructor and Description
SafeResourceReader()

Method Summary

Methods

Modifier and Type	Method and Description
void	setup(org.apache.cocoon.environment.SourceResolver resolver, java.util.Map objectModel, java.lang.String src, org.apache.avalon.framework.parameters.Parameters par) Setup the reader.

Methods inherited from class org.apache.cocoon.reading.ResourceReader

configure, generate, getKey, getLastModified, getMimeType, getValidity, hasRanges, processStream, recycle, setBufferSize, setByteRanges, setExpires, setQuickTest, setupHeaders

Methods inherited from class org.apache.cocoon.reading.AbstractReader

setOutputStream, shouldSetContentLength

Methods inherited from class org.apache.cocoon.util.AbstractLogEnabled

getLogger, setLogger

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.apache.cocoon.caching.CacheableProcessingComponent

getKey, getValidity

Methods inherited from interface org.apache.avalon.framework.configuration.Configurable

configure

Constructor Detail

SafeResourceReader

public SafeResourceReader()

Method Detail

setup

public void setup(org.apache.cocoon.environment.SourceResolver resolver,
         java.util.Map objectModel,
         java.lang.String src,
         org.apache.avalon.framework.parameters.Parameters par)
           throws org.apache.cocoon.ProcessingException,
                  org.xml.sax.SAXException,
                  java.io.IOException

Setup the reader. The resource is opened to get an InputStream, the length and the last modification date

Specified by:

setup in interface org.apache.cocoon.sitemap.SitemapModelComponent

Overrides:

setup in class org.apache.cocoon.reading.ResourceReader

Throws:

org.apache.cocoon.ProcessingException

org.xml.sax.SAXException

java.io.IOException