RFR: 8319332: Security properties files inclusion [v7]

Weijun Wang weijun at openjdk.org
Fri Apr 19 14:14:59 UTC 2024


On Fri, 19 Apr 2024 13:31:42 GMT, Francisco Ferrari Bihurriet <fferrari at openjdk.org> wrote:

>> Oh, I meant the final `else`. What does it mean if a file is neither "regular" nor "directory"? Also I don't quite understand why one uses `toRealPath` and one uses `toAbsolutePath`. Is this related to resolving a symlink?
>
> Oh, I see now, _Linux_ pipes are examples of non-regular + non-directory at the same time, where `Path::toAbsolutePath()` works but `Path::toRealPath()` fails:
> 
> 
> [fferrari at vmhost ~]$ jshell -<<<'System.out.println(Path.of("/dev/stdin").toAbsolutePath())'
> /dev/stdin
> [fferrari at vmhost ~]$ jshell -<<<'System.out.println(Path.of("/dev/stdin").toRealPath())'
> Exception java.nio.file.NoSuchFileException: /dev/stdin
>       at UnixException.translateToIOException (UnixException.java:92)
>       at UnixException.rethrowAsIOException (UnixException.java:106)
>       at UnixException.rethrowAsIOException (UnixException.java:111)
>       at UnixPath.toRealPath (UnixPath.java:825)
>       at (#1:1)
> 
> 
> That change was introduced to avoid a regression, please see [this comment](https://github.com/openjdk/jdk/pull/16483#issuecomment-1881663782) (and the commit message).

Thanks. So only real file has real path.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/16483#discussion_r1572442341



More information about the security-dev mailing list