diff options
| -rw-r--r-- | poi/src/main/java/org/apache/poi/hpsf/ClassID.java | 5 | ||||
| -rw-r--r-- | poi/src/test/java/org/apache/poi/util/TestIOUtils.java | 13 |
2 files changed, 12 insertions, 6 deletions
diff --git a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java index 7e0ec5e2d8..688fd6fa0c 100644 --- a/poi/src/main/java/org/apache/poi/hpsf/ClassID.java +++ b/poi/src/main/java/org/apache/poi/hpsf/ClassID.java @@ -109,11 +109,12 @@ public class ClassID implements Duplicatable, GenericRecord { /** * Gets the bytes making out the class ID. They are returned in correct order, i.e. big-endian. + * This no longer returns a reference to the internal byte array, but a copy of it. * * @return the bytes making out the class ID. */ public byte[] getBytes() { - return bytes; + return bytes.clone(); } /** @@ -152,7 +153,7 @@ public class ClassID implements Duplicatable, GenericRecord { /* Read 8 bytes. */ System.arraycopy(src, 8 + offset, bytes, 8, 8); - return bytes; + return bytes.clone(); } /** diff --git a/poi/src/test/java/org/apache/poi/util/TestIOUtils.java b/poi/src/test/java/org/apache/poi/util/TestIOUtils.java index 094e138eef..9c026b14d4 100644 --- a/poi/src/test/java/org/apache/poi/util/TestIOUtils.java +++ b/poi/src/test/java/org/apache/poi/util/TestIOUtils.java @@ -580,7 +580,7 @@ final class TestIOUtils { void testNewFile() throws IOException { final File parent = TempFile.createTempDirectory("create-file-test"); try { - final String path0 = "path/to/file.txt"; + final String path0 = windowsPathIfNecessary("path/to/file.txt"); final File outFile = IOUtils.newFile(parent, path0); assertTrue(outFile.getAbsolutePath().endsWith(path0), "unexpected path: " + outFile.getAbsolutePath()); @@ -594,7 +594,7 @@ final class TestIOUtils { final File parent = TempFile.createTempDirectory("path-traversal-test"); try { // this path is ok because it doesn't walk out of the parent directory - final String path0 = "a/b/c/../d/e/../../f/g/./h"; + final String path0 = windowsPathIfNecessary("a/b/c/../d/e/../../f/g/./h"); File outFile = IOUtils.newFile(parent, path0); assertTrue(outFile.getAbsolutePath().endsWith(path0), "unexpected path: " + outFile.getAbsolutePath()); @@ -609,7 +609,7 @@ final class TestIOUtils { try { // this path is ok because it doesn't walk out of the parent directory // the initial slash is ignored and the generated path is relative to the parent directory - final String path0 = "/a/b/c.txt"; + final String path0 = windowsPathIfNecessary("/a/b/c.txt"); File outFile = IOUtils.newFile(parent, path0); assertTrue(outFile.getAbsolutePath().endsWith(path0), "unexpected path: " + outFile.getAbsolutePath()); @@ -622,13 +622,18 @@ final class TestIOUtils { void testDisallowedPathTraversal() throws IOException { final File parent = TempFile.createTempDirectory("path-traversal-test"); try { - final String path0 = "../a/b/c.txt"; + final String path0 = windowsPathIfNecessary("../a/b/c.txt"); Assertions.assertThrows(IOException.class, () -> IOUtils.newFile(parent, path0)); } finally { assertTrue(parent.delete()); } } + private static String windowsPathIfNecessary(String path) { + // this is a workaround for the Windows file system which doesn't allow slashes in file names + return File.separatorChar == '/' ? path : path.replace('/', File.separatorChar); + } + /** * This returns 0 for the first call to skip and then reads * as requested. This tests that the fallback to read() works. |