• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

tomdesair / tus-java-server / 27478147406

13 Jun 2026 08:26PM UTC coverage: 94.92% (+0.01%) from 94.91%
27478147406

Pull #85

github

web-flow
Merge 56a3ed9a2 into ec406348a
Pull Request #85: Validate and canonicalize Upload-Checksum value to prevent path traversal vulnerability

621 of 698 branches covered (88.97%)

Branch coverage included in aggregate %.

35 of 35 new or added lines in 16 files covered. (100.0%)

18 existing lines in 4 files now uncovered.

1808 of 1861 relevant lines covered (97.15%)

6.56 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

90.0
/src/main/java/me/desair/tus/server/upload/disk/FileBasedLock.java
1
package me.desair.tus.server.upload.disk;
2

3
import static java.nio.file.StandardOpenOption.CREATE;
4
import static java.nio.file.StandardOpenOption.WRITE;
5

6
import java.io.IOException;
7
import java.nio.channels.FileChannel;
8
import java.nio.channels.FileLock;
9
import java.nio.channels.OverlappingFileLockException;
10
import java.nio.file.Files;
11
import java.nio.file.Path;
12
import java.util.Objects;
13
import me.desair.tus.server.exception.UploadAlreadyLockedException;
14
import me.desair.tus.server.upload.UploadLock;
15
import me.desair.tus.server.util.Utils;
16
import org.apache.commons.lang3.Validate;
17
import org.slf4j.Logger;
18
import org.slf4j.LoggerFactory;
19

20
/**
21
 * Upload locking implementation using the file system file locking mechanism. File locking can also
22
 * apply to shared network drives. This way the framework supports clustering as long as the upload
23
 * storage directory is mounted as a shared (network) drive. <br>
24
 * File locks are also automatically released on application (JVM) shutdown. This means the file
25
 * locking is not persistent and prevents cleanup and stale lock issues.
26
 */
27
public class FileBasedLock implements UploadLock {
28

29
  private static final Logger log = LoggerFactory.getLogger(FileBasedLock.class);
8✔
30

31
  private String uploadUri;
32
  private FileChannel fileChannel = null;
6✔
33
  protected Path lockPath;
34

35
  /** Constructor. */
36
  public FileBasedLock(String uploadUri, Path lockPath)
37
      throws UploadAlreadyLockedException, IOException {
4✔
38
    Validate.notBlank(uploadUri, "The upload URI cannot be blank");
12✔
39
    Objects.requireNonNull(lockPath, "The path to the lock cannot be null");
8✔
40
    this.uploadUri = uploadUri;
6✔
41
    this.lockPath = lockPath;
6✔
42

43
    tryToObtainFileLock();
4✔
44
  }
2✔
45

46
  private void tryToObtainFileLock() throws UploadAlreadyLockedException, IOException {
47
    String message = "The upload " + getUploadUri() + " is already locked";
8✔
48

49
    try {
50
      // Try to acquire a lock
51
      fileChannel = createFileChannel();
8✔
52
      FileLock fileLock = Utils.lockFileExclusively(fileChannel);
8✔
53

54
      // If the upload is already locked, our lock will be null
55
      if (fileLock == null) {
4✔
56
        fileChannel.close();
3✔
57
        throw new UploadAlreadyLockedException(message);
5✔
58
      }
59

60
    } catch (OverlappingFileLockException e) {
2✔
61
      if (fileChannel != null) {
6!
62
        try {
63
          fileChannel.close();
6✔
UNCOV
64
        } catch (IOException e1) {
×
65
          // Should not happen
66
        }
2✔
67
      }
68
      throw new UploadAlreadyLockedException(message);
10✔
69
    } catch (IOException e) {
1✔
70
      throw new IOException(
6✔
71
          "Unable to create or open file required to implement file-based locking", e);
72
    }
2✔
73
  }
2✔
74

75
  @Override
76
  public String getUploadUri() {
77
    return uploadUri;
6✔
78
  }
79

80
  public Path getLockPath() {
81
    return lockPath;
6✔
82
  }
83

84
  @Override
85
  public void release() {
86
    try {
87
      // Closing the channel will also release the lock
88
      fileChannel.close();
6✔
89
      Files.deleteIfExists(lockPath);
8✔
UNCOV
90
    } catch (IOException e) {
×
91
      log.warn("Unable to release file lock for URI " + getUploadUri(), e);
×
92
    }
2✔
93
  }
2✔
94

95
  @Override
96
  public void close() throws IOException {
97
    release();
4✔
98
  }
2✔
99

100
  protected FileChannel createFileChannel() throws IOException {
101
    return FileChannel.open(lockPath, CREATE, WRITE);
28✔
102
  }
103
}
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc