diff --git a/jetty-server/src/main/java/org/eclipse/jetty/server/Server.java b/jetty-server/src/main/java/org/eclipse/jetty/server/Server.java index 404cc69815a5..55eb8a9b9cbf 100644 --- a/jetty-server/src/main/java/org/eclipse/jetty/server/Server.java +++ b/jetty-server/src/main/java/org/eclipse/jetty/server/Server.java @@ -80,6 +80,7 @@ public class Server extends HandlerWrapper implements Attributes private final ThreadPool _threadPool; private final List _connectors = new CopyOnWriteArrayList<>(); private SessionIdManager _sessionIdManager; + private String _tmpDirPosixPerms = "rwx------"; private boolean _stopAtShutdown; private boolean _dumpAfterStart = false; private boolean _dumpBeforeStop = false; @@ -210,6 +211,11 @@ public void setStopAtShutdown(boolean stop) _stopAtShutdown = stop; } + public String getTempDirectoryPosixPermissions() + { + return _tmpDirPosixPerms; + } + /** * @return Returns the connectors. */ @@ -583,6 +589,17 @@ public void setSessionIdManager(SessionIdManager sessionIdManager) _sessionIdManager = sessionIdManager; } + /** + * Set the POSIX permission string used for the Temp Directory creation for all webapps deployed on the server. + * + * @param perms the string for temp directory permissions + * @see java.nio.file.attribute.PosixFilePermissions#fromString(String) + */ + public void setTempDirectoryPosixPermissions(String perms) + { + _tmpDirPosixPerms = perms; + } + /* * @see org.eclipse.util.AttributesMap#clearAttributes() */ diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java b/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java index 9c0c71a065b8..0ccd1ec969d3 100644 --- a/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java +++ b/jetty-util/src/main/java/org/eclipse/jetty/util/IO.java @@ -34,16 +34,8 @@ import java.nio.ByteBuffer; import java.nio.channels.GatheringByteChannel; import java.nio.charset.Charset; -import java.nio.file.FileStore; import java.nio.file.Files; import java.nio.file.Path; -import java.nio.file.attribute.DosFileAttributeView; -import java.nio.file.attribute.FileAttribute; -import java.nio.file.attribute.PosixFileAttributeView; -import java.nio.file.attribute.PosixFilePermission; -import java.nio.file.attribute.PosixFilePermissions; -import java.util.HashSet; -import java.util.Objects; import org.eclipse.jetty.util.log.Log; import org.eclipse.jetty.util.log.Logger; @@ -57,24 +49,6 @@ public class IO { private static final Logger LOG = Log.getLogger(IO.class); - private static final FileAttribute[] NO_FILE_ATTRIBUTES = new FileAttribute[0]; - private static final FileAttribute[] USER_ONLY_POSIX_FILE_ATTRIBUTES = - new FileAttribute[]{ - PosixFilePermissions.asFileAttribute( - new HashSet() - { - { - add(PosixFilePermission.OWNER_EXECUTE); - add(PosixFilePermission.OWNER_READ); - add(PosixFilePermission.OWNER_WRITE); - // we don't add GROUP or OTHER write perms here. - add(PosixFilePermission.GROUP_READ); - add(PosixFilePermission.OTHERS_READ); - } - } - ) - }; - public static final String CRLF = "\r\n"; @@ -462,58 +436,6 @@ public static void close(Writer writer) close((Closeable)writer); } - /** - * Get the array of {@link FileAttribute} values for the provided path - * that will set the path to Full Read/Write for the user running Jetty, - * but Readonly for other users. - *

- * For Unix, that's means {@link java.nio.file.attribute.PosixFileAttributes} - * where the World and Other groups have their read / write flags removed. - *

- *

- * For Windows / Dos, that means {@link java.nio.file.attribute.DosFileAttributes} - *

- */ - public static FileAttribute[] getUserPrivateFileAttribute(Path path) - { - FileStore fileStore = null; - try - { - // Obtain a reference to the FileStore to know what kind of read-only we are capable of. - fileStore = Files.getFileStore(Objects.requireNonNull(path)); - - if (fileStore == null) - { - // Not on a properly implemented FileStore (seen with 3rd party FileStore implementations) - // We cannot do anything in this case, so just return. - return NO_FILE_ATTRIBUTES; - } - - if (fileStore.supportsFileAttributeView(DosFileAttributeView.class)) - { - // We are on a Windows / DOS filesystem. - // It might support ACL, but we don't attempt to support that here. - return NO_FILE_ATTRIBUTES; - } - - if (fileStore.supportsFileAttributeView(PosixFileAttributeView.class)) - { - // We are on a Unix / Linux / OSX system - return USER_ONLY_POSIX_FILE_ATTRIBUTES; - } - - // If we reached this point, we have a Path on a FileSystem / FileStore that we cannot control. - // So skip the attempt to set readable. - } - catch (IOException e) - { - if (LOG.isDebugEnabled()) - LOG.debug("Unable to determine attribute types on path: {}", path, e); - } - - return NO_FILE_ATTRIBUTES; - } - public static byte[] readBytes(InputStream in) throws IOException { diff --git a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebAppContext.java b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebAppContext.java index 97f388710ec3..75da54536c6f 100644 --- a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebAppContext.java +++ b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebAppContext.java @@ -60,6 +60,7 @@ import org.eclipse.jetty.util.AttributesMap; import org.eclipse.jetty.util.Loader; import org.eclipse.jetty.util.MultiException; +import org.eclipse.jetty.util.StringUtil; import org.eclipse.jetty.util.URIUtil; import org.eclipse.jetty.util.annotation.ManagedAttribute; import org.eclipse.jetty.util.annotation.ManagedObject; @@ -177,6 +178,7 @@ public class WebAppContext extends ServletContextHandler implements WebAppClassL private File _tmpDir; private boolean _persistTmpDir = false; + private String _tmpDirPosixPerms; private String _war; private String _extraClasspath; @@ -517,6 +519,11 @@ protected void doStart() throws Exception { try { + if (StringUtil.isBlank(_tmpDirPosixPerms)) + { + _tmpDirPosixPerms = getServer().getTempDirectoryPosixPermissions(); + } + _metadata.setAllowDuplicateFragmentNames(isAllowDuplicateFragmentNames()); Boolean validate = (Boolean)getAttribute(MetaData.VALIDATE_XML); _metadata.setValidateXml((validate != null && validate)); @@ -1298,12 +1305,29 @@ public void setTempDirectory(File dir) setAttribute(TEMPDIR, _tmpDir); } + /** + * Set the POSIX permission string used for the Temp Directory for this specific webapp. + * + * @param perms the string for temp directory permissions + * @see java.nio.file.attribute.PosixFilePermissions#fromString(String) + */ + public void setTempDirectoryPosixPermissions(String perms) + { + this._tmpDirPosixPerms = perms; + } + @ManagedAttribute(value = "temporary directory location", readonly = true) public File getTempDirectory() { return _tmpDir; } + @ManagedAttribute(value = "temporary directory perms", readonly = true) + public String getTempDirectoryPosixPermissions() + { + return _tmpDirPosixPerms; + } + /** * If true the temp directory for this * webapp will be kept when the webapp stops. Otherwise, diff --git a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java index 1cf5b756964f..d81885c220e1 100644 --- a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java +++ b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java @@ -24,8 +24,12 @@ import java.net.URISyntaxException; import java.net.URL; import java.net.URLClassLoader; +import java.nio.file.FileStore; import java.nio.file.Files; import java.nio.file.Path; +import java.nio.file.attribute.PosixFileAttributeView; +import java.nio.file.attribute.PosixFilePermission; +import java.nio.file.attribute.PosixFilePermissions; import java.util.ArrayList; import java.util.Arrays; import java.util.List; @@ -507,8 +511,18 @@ public void makeTempDirectory(File parent, WebAppContext context) } else { - //ensure file will always be unique by appending random digits - tmpDir = Files.createTempDirectory(parent.toPath(), temp, IO.getUserPrivateFileAttribute(parent.toPath())).toFile(); + Path parentPath = parent.toPath(); + FileStore fileStore = Files.getFileStore(parentPath); + if (fileStore.supportsFileAttributeView(PosixFileAttributeView.class)) + { + String workDirPerms = context.getTempDirectoryPosixPermissions(); + Set permSet = PosixFilePermissions.fromString(workDirPerms); + tmpDir = Files.createTempDirectory(parentPath, temp, PosixFilePermissions.asFileAttribute(permSet)).toFile(); + } + else + { + tmpDir = Files.createTempDirectory(parentPath, temp).toFile(); + } } configureTempDirectory(tmpDir, context);