|
| 1 | +/* |
| 2 | + * Copyright (C) 2007 The Guava Authors |
| 3 | + * |
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except |
| 5 | + * in compliance with the License. You may obtain a copy of the License at |
| 6 | + * |
| 7 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | + * |
| 9 | + * Unless required by applicable law or agreed to in writing, software distributed under the License |
| 10 | + * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express |
| 11 | + * or implied. See the License for the specific language governing permissions and limitations under |
| 12 | + * the License. |
| 13 | + */ |
| 14 | + |
| 15 | +package com.google.common.io; |
| 16 | + |
| 17 | +import static com.google.common.base.StandardSystemProperty.JAVA_IO_TMPDIR; |
| 18 | + |
| 19 | +import com.google.common.annotations.GwtIncompatible; |
| 20 | +import com.google.common.annotations.J2ktIncompatible; |
| 21 | +import com.google.j2objc.annotations.J2ObjCIncompatible; |
| 22 | +import java.io.File; |
| 23 | +import java.io.IOException; |
| 24 | +import java.nio.file.Paths; |
| 25 | +import java.nio.file.attribute.FileAttribute; |
| 26 | +import java.nio.file.attribute.PosixFilePermission; |
| 27 | +import java.nio.file.attribute.PosixFilePermissions; |
| 28 | +import java.util.Set; |
| 29 | + |
| 30 | +/** |
| 31 | + * Creates temporary files and directories whose permissions are restricted to the current user or, |
| 32 | + * in the case of Android, the current app. If that is not possible (as is the case under the very |
| 33 | + * old Android Ice Cream Sandwich release), then this class throws an exception instead of creating |
| 34 | + * a file or directory that would be more accessible. |
| 35 | + */ |
| 36 | +@J2ktIncompatible |
| 37 | +@GwtIncompatible |
| 38 | +@J2ObjCIncompatible |
| 39 | +@ElementTypesAreNonnullByDefault |
| 40 | +abstract class TempFileCreator { |
| 41 | + static final TempFileCreator INSTANCE = pickSecureCreator(); |
| 42 | + |
| 43 | + /** |
| 44 | + * @throws IllegalStateException if the directory could not be created (to implement the contract |
| 45 | + * of {@link Files#createTempDir()} |
| 46 | + * @throws UnsupportedOperationException if the system does not support creating temporary |
| 47 | + * directories securely |
| 48 | + */ |
| 49 | + abstract File createTempDir(); |
| 50 | + |
| 51 | + abstract File createTempFile(String prefix) throws IOException; |
| 52 | + |
| 53 | + private static TempFileCreator pickSecureCreator() { |
| 54 | + try { |
| 55 | + Class.forName("java.nio.file.Path"); |
| 56 | + return new JavaNioCreator(); |
| 57 | + } catch (ClassNotFoundException runningUnderAndroid) { |
| 58 | + // Try another way. |
| 59 | + } |
| 60 | + |
| 61 | + try { |
| 62 | + int version = (int) Class.forName("android.os.Build$VERSION").getField("SDK_INT").get(null); |
| 63 | + int jellyBean = |
| 64 | + (int) Class.forName("android.os.Build$VERSION_CODES").getField("JELLY_BEAN").get(null); |
| 65 | + /* |
| 66 | + * I assume that this check can't fail because JELLY_BEAN will be present only if we're |
| 67 | + * running under Jelly Bean or higher. But it seems safest to check. |
| 68 | + */ |
| 69 | + if (version < jellyBean) { |
| 70 | + return new ThrowingCreator(); |
| 71 | + } |
| 72 | + |
| 73 | + // Don't merge these catch() blocks, let alone use ReflectiveOperationException directly: |
| 74 | + // b/65343391 |
| 75 | + } catch (NoSuchFieldException e) { |
| 76 | + // The JELLY_BEAN field doesn't exist because we're running on a version before Jelly Bean :) |
| 77 | + return new ThrowingCreator(); |
| 78 | + } catch (ClassNotFoundException e) { |
| 79 | + // Should be impossible, but we want to return *something* so that class init succeeds. |
| 80 | + return new ThrowingCreator(); |
| 81 | + } catch (IllegalAccessException e) { |
| 82 | + // ditto |
| 83 | + return new ThrowingCreator(); |
| 84 | + } |
| 85 | + |
| 86 | + // Android isolates apps' temporary directories since Jelly Bean: |
| 87 | + // https://github.com/google/guava/issues/4011#issuecomment-770020802 |
| 88 | + // So we can create files there with any permissions and still get security from the isolation. |
| 89 | + return new JavaIoCreator(); |
| 90 | + } |
| 91 | + |
| 92 | + @IgnoreJRERequirement // used only when Path is available |
| 93 | + private static final class JavaNioCreator extends TempFileCreator { |
| 94 | + private static final FileAttribute<Set<PosixFilePermission>> RWX_USER_ONLY = |
| 95 | + PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rwx------")); |
| 96 | + private static final FileAttribute<Set<PosixFilePermission>> RW_USER_ONLY = |
| 97 | + PosixFilePermissions.asFileAttribute(PosixFilePermissions.fromString("rw-------")); |
| 98 | + |
| 99 | + @Override |
| 100 | + File createTempDir() { |
| 101 | + try { |
| 102 | + return java.nio.file.Files.createTempDirectory( |
| 103 | + Paths.get(JAVA_IO_TMPDIR.value()), /* prefix= */ null, RWX_USER_ONLY) |
| 104 | + .toFile(); |
| 105 | + } catch (IOException e) { |
| 106 | + throw new IllegalStateException("Failed to create directory", e); |
| 107 | + } |
| 108 | + } |
| 109 | + |
| 110 | + @Override |
| 111 | + File createTempFile(String prefix) throws IOException { |
| 112 | + return java.nio.file.Files.createTempFile( |
| 113 | + Paths.get(JAVA_IO_TMPDIR.value()), |
| 114 | + /* prefix= */ prefix, |
| 115 | + /* suffix= */ null, |
| 116 | + RW_USER_ONLY) |
| 117 | + .toFile(); |
| 118 | + } |
| 119 | + } |
| 120 | + |
| 121 | + private static final class JavaIoCreator extends TempFileCreator { |
| 122 | + @Override |
| 123 | + File createTempDir() { |
| 124 | + File baseDir = new File(JAVA_IO_TMPDIR.value()); |
| 125 | + @SuppressWarnings("GoodTime") // reading system time without TimeSource |
| 126 | + String baseName = System.currentTimeMillis() + "-"; |
| 127 | + |
| 128 | + for (int counter = 0; counter < TEMP_DIR_ATTEMPTS; counter++) { |
| 129 | + File tempDir = new File(baseDir, baseName + counter); |
| 130 | + if (tempDir.mkdir()) { |
| 131 | + return tempDir; |
| 132 | + } |
| 133 | + } |
| 134 | + throw new IllegalStateException( |
| 135 | + "Failed to create directory within " |
| 136 | + + TEMP_DIR_ATTEMPTS |
| 137 | + + " attempts (tried " |
| 138 | + + baseName |
| 139 | + + "0 to " |
| 140 | + + baseName |
| 141 | + + (TEMP_DIR_ATTEMPTS - 1) |
| 142 | + + ')'); |
| 143 | + } |
| 144 | + |
| 145 | + @Override |
| 146 | + File createTempFile(String prefix) throws IOException { |
| 147 | + return File.createTempFile( |
| 148 | + /* prefix= */ prefix, |
| 149 | + /* suffix= */ null, |
| 150 | + /* directory= */ null /* defaults to java.io.tmpdir */); |
| 151 | + } |
| 152 | + |
| 153 | + /** Maximum loop count when creating temp directories. */ |
| 154 | + private static final int TEMP_DIR_ATTEMPTS = 10000; |
| 155 | + } |
| 156 | + |
| 157 | + private static final class ThrowingCreator extends TempFileCreator { |
| 158 | + private static final String MESSAGE = |
| 159 | + "Guava cannot securely create temporary files or directories under SDK versions before" |
| 160 | + + " Jelly Bean. You can create one yourself, either in the insecure default directory" |
| 161 | + + " or in a more secure directory, such as context.getCacheDir(). For more information," |
| 162 | + + " see the Javadoc for Files.createTempDir()."; |
| 163 | + |
| 164 | + @Override |
| 165 | + File createTempDir() { |
| 166 | + throw new IllegalStateException(MESSAGE); |
| 167 | + } |
| 168 | + |
| 169 | + @Override |
| 170 | + File createTempFile(String prefix) throws IOException { |
| 171 | + throw new IOException(MESSAGE); |
| 172 | + } |
| 173 | + } |
| 174 | + |
| 175 | + private TempFileCreator() {} |
| 176 | +} |
0 commit comments