27478147406

Committed 13 Jun 2026 08:26PM UTC coverage: 94.92% (+0.01%) from 94.91%

Build # 27478147406

Build Type

Pull #85

github

Committed by

web-flow

Commit Message

Merge 56a3ed9a2 into ec406348a

Pull Request Pull Request #85: Validate and canonicalize Upload-Checksum value to prevent path traversal vulnerability

Coverage Stats

621 of 698 branches covered (88.97%)

Branch coverage included in aggregate %.

35 of 35 new or added lines in 16 files covered. (100.0%)

18 existing lines in 4 files now uncovered.

1808 of 1861 relevant lines covered (97.15%)

6.56 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.0

/src/main/java/me/desair/tus/server/upload/disk/FileBasedLock.java

package me.desair.tus.server.upload.disk;

import static java.nio.file.StandardOpenOption.CREATE;
import static java.nio.file.StandardOpenOption.WRITE;

import java.io.IOException;
import java.nio.channels.FileChannel;
import java.nio.channels.FileLock;
import java.nio.channels.OverlappingFileLockException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.Objects;
import me.desair.tus.server.exception.UploadAlreadyLockedException;
import me.desair.tus.server.upload.UploadLock;
import me.desair.tus.server.util.Utils;
import org.apache.commons.lang3.Validate;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Upload locking implementation using the file system file locking mechanism. File locking can also
 * apply to shared network drives. This way the framework supports clustering as long as the upload
 * storage directory is mounted as a shared (network) drive. <br>
 * File locks are also automatically released on application (JVM) shutdown. This means the file
 * locking is not persistent and prevents cleanup and stale lock issues.
 */
public class FileBasedLock implements UploadLock {

  private static final Logger log = LoggerFactory.getLogger(FileBasedLock.class);

  private String uploadUri;
  private FileChannel fileChannel = null;
  protected Path lockPath;

  /** Constructor. */
  public FileBasedLock(String uploadUri, Path lockPath)
      throws UploadAlreadyLockedException, IOException {
    Validate.notBlank(uploadUri, "The upload URI cannot be blank");
    Objects.requireNonNull(lockPath, "The path to the lock cannot be null");
    this.uploadUri = uploadUri;
    this.lockPath = lockPath;

    tryToObtainFileLock();
  }

  private void tryToObtainFileLock() throws UploadAlreadyLockedException, IOException {
    String message = "The upload " + getUploadUri() + " is already locked";

    try {
      // Try to acquire a lock
      fileChannel = createFileChannel();
      FileLock fileLock = Utils.lockFileExclusively(fileChannel);

      // If the upload is already locked, our lock will be null
      if (fileLock == null) {
        fileChannel.close();
        throw new UploadAlreadyLockedException(message);
      }

    } catch (OverlappingFileLockException e) {
      if (fileChannel != null) {
        try {
          fileChannel.close();
        } catch (IOException e1) {
          // Should not happen
        }
      }
      throw new UploadAlreadyLockedException(message);
    } catch (IOException e) {
      throw new IOException(
          "Unable to create or open file required to implement file-based locking", e);
    }
  }

  @Override
  public String getUploadUri() {
    return uploadUri;
  }

  public Path getLockPath() {
    return lockPath;
  }

  @Override
  public void release() {
    try {
      // Closing the channel will also release the lock
      fileChannel.close();
      Files.deleteIfExists(lockPath);
    } catch (IOException e) {
      log.warn("Unable to release file lock for URI " + getUploadUri(), e);
    }
  }

  @Override
  public void close() throws IOException {
    release();
  }

  protected FileChannel createFileChannel() throws IOException {
    return FileChannel.open(lockPath, CREATE, WRITE);
  }
}

1	package me.desair.tus.server.upload.disk;
2
3	import static java.nio.file.StandardOpenOption.CREATE;
4	import static java.nio.file.StandardOpenOption.WRITE;
5
6	import java.io.IOException;
7	import java.nio.channels.FileChannel;
8	import java.nio.channels.FileLock;
9	import java.nio.channels.OverlappingFileLockException;
10	import java.nio.file.Files;
11	import java.nio.file.Path;
12	import java.util.Objects;
13	import me.desair.tus.server.exception.UploadAlreadyLockedException;
14	import me.desair.tus.server.upload.UploadLock;
15	import me.desair.tus.server.util.Utils;
16	import org.apache.commons.lang3.Validate;
17	import org.slf4j.Logger;
18	import org.slf4j.LoggerFactory;
19
20	/**
21	* Upload locking implementation using the file system file locking mechanism. File locking can also
22	* apply to shared network drives. This way the framework supports clustering as long as the upload
23	* storage directory is mounted as a shared (network) drive. <br>
24	* File locks are also automatically released on application (JVM) shutdown. This means the file
25	* locking is not persistent and prevents cleanup and stale lock issues.
26	*/
27	public class FileBasedLock implements UploadLock {
28
29	private static final Logger log = LoggerFactory.getLogger(FileBasedLock.class);	8✔
30
31	private String uploadUri;
32	private FileChannel fileChannel = null;	6✔
33	protected Path lockPath;
34
35	/** Constructor. */
36	public FileBasedLock(String uploadUri, Path lockPath)
37	throws UploadAlreadyLockedException, IOException {	4✔
38	Validate.notBlank(uploadUri, "The upload URI cannot be blank");	12✔
39	Objects.requireNonNull(lockPath, "The path to the lock cannot be null");	8✔
40	this.uploadUri = uploadUri;	6✔
41	this.lockPath = lockPath;	6✔
42
43	tryToObtainFileLock();	4✔
44	}	2✔
45
46	private void tryToObtainFileLock() throws UploadAlreadyLockedException, IOException {
47	String message = "The upload " + getUploadUri() + " is already locked";	8✔
48
49	try {
50	// Try to acquire a lock
51	fileChannel = createFileChannel();	8✔
52	FileLock fileLock = Utils.lockFileExclusively(fileChannel);	8✔
53
54	// If the upload is already locked, our lock will be null
55	if (fileLock == null) {	4✔
56	fileChannel.close();	3✔
57	throw new UploadAlreadyLockedException(message);	5✔
58	}
59
60	} catch (OverlappingFileLockException e) {	2✔
61	if (fileChannel != null) {	6!
62	try {
63	fileChannel.close();	6✔
UNCOV 64	} catch (IOException e1) {	×
65	// Should not happen
66	}	2✔
67	}
68	throw new UploadAlreadyLockedException(message);	10✔
69	} catch (IOException e) {	1✔
70	throw new IOException(	6✔
71	"Unable to create or open file required to implement file-based locking", e);
72	}	2✔
73	}	2✔
74
75	@Override
76	public String getUploadUri() {
77	return uploadUri;	6✔
78	}
79
80	public Path getLockPath() {
81	return lockPath;	6✔
82	}
83
84	@Override
85	public void release() {
86	try {
87	// Closing the channel will also release the lock
88	fileChannel.close();	6✔
89	Files.deleteIfExists(lockPath);	8✔
UNCOV 90	} catch (IOException e) {	×
91	log.warn("Unable to release file lock for URI " + getUploadUri(), e);	×
92	}	2✔
93	}	2✔
94
95	@Override
96	public void close() throws IOException {
97	release();	4✔
98	}	2✔
99
100	protected FileChannel createFileChannel() throws IOException {
101	return FileChannel.open(lockPath, CREATE, WRITE);	28✔
102	}
103	}

tomdesair / tus-java-server / 27478147406

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous