3909N/A * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved. 0N/A * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 0N/A * This code is free software; you can redistribute it and/or modify it 0N/A * under the terms of the GNU General Public License version 2 only, as 2362N/A * published by the Free Software Foundation. Oracle designates this 0N/A * particular file as subject to the "Classpath" exception as provided 2362N/A * by Oracle in the LICENSE file that accompanied this code. 0N/A * This code is distributed in the hope that it will be useful, but WITHOUT 0N/A * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 0N/A * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 0N/A * version 2 for more details (a copy is included in the LICENSE file that 0N/A * accompanied this code). 0N/A * You should have received a copy of the GNU General Public License version 0N/A * 2 along with this work; if not, write to the Free Software Foundation, 0N/A * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 2362N/A * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA 2362N/A * or visit www.oracle.com if you need additional information or have any 0N/A * This class represents access to a file or directory. A FilePermission consists 0N/A * of a pathname and a set of actions valid for that pathname. 0N/A * Pathname is the pathname of the file or directory granted the specified 0N/A * actions. A pathname that ends in "/*" (where "/" is 0N/A * the file separator character, <code>File.separatorChar</code>) indicates 0N/A * all the files and directories contained in that directory. A pathname 0N/A * that ends with "/-" indicates (recursively) all files 0N/A * and subdirectories contained in that directory. A pathname consisting of 0N/A * the special token "<<ALL FILES>>" matches <b>any</b> file. 0N/A * Note: A pathname consisting of a single "*" indicates all the files 0N/A * in the current directory, while a pathname consisting of a single "-" 0N/A * indicates all the files in the current directory and 0N/A * (recursively) all files and subdirectories contained in the current 0N/A * The actions to be granted are passed to the constructor in a string containing 0N/A * a list of one or more comma-separated keywords. The possible keywords are 893N/A * "read", "write", "execute", "delete", and "readlink". Their meaning is 0N/A * <DT> read <DD> read permission 0N/A * <DT> write <DD> write permission 0N/A * <DD> execute permission. Allows <code>Runtime.exec</code> to 0N/A * be called. Corresponds to <code>SecurityManager.checkExec</code>. 0N/A * <DD> delete permission. Allows <code>File.delete</code> to 0N/A * be called. Corresponds to <code>SecurityManager.checkDelete</code>. 893N/A * <DD> read link permission. Allows the target of a 3471N/A * to be read by invoking the {@link java.nio.file.Files#readSymbolicLink 893N/A * readSymbolicLink } method. 0N/A * The actions string is converted to lowercase before processing. 0N/A * Be careful when granting FilePermissions. Think about the implications 0N/A * of granting read and especially write access to various files and 0N/A * directories. The "<<ALL FILES>>" permission with write action is 0N/A * especially dangerous. This grants permission to write to the entire 0N/A * file system. One thing this effectively allows is replacement of the 0N/A * system binary, including the JVM runtime environment. 0N/A * <p>Please note: Code can always read a file from the same 0N/A * directory it's in (or a subdirectory of that directory); it does not 0N/A * need explicit permission to do so. 0N/A * @see java.security.Permission 0N/A * @see java.security.Permissions 0N/A * @see java.security.PermissionCollection 0N/A * @author Marianne Mueller 0N/A * @author Roland Schemers 0N/A private final static int READ =
0x4;
893N/A * All actions (read,write,execute,delete,readlink) 0N/A private final static int NONE =
0x0;
0N/A // does path indicate a directory? (wildcard or recursive) 0N/A // is it a recursive directory specification? 0N/A * the actions string. 0N/A // created and re-used in the getAction function. 0N/A // canonicalized dir path. In the case of 0N/A // directories, it is the name "/blah/*" or "/blah/-" without 0N/A // the last character (the "*" or "-"). 0N/A // static Strings used by init(int mask) 0N/A public String toString() 0N/A StringBuffer sb = new StringBuffer(); 0N/A sb.append("cpath = "+cpath+"\n"); 0N/A sb.append("mask = "+mask+"\n"); 0N/A sb.append("actions = "+getActions()+"\n"); 0N/A sb.append("directory = "+directory+"\n"); 0N/A sb.append("recursive = "+recursive+"\n"); 0N/A return sb.toString(); 0N/A * initialize a FilePermission object. Common to all constructors. 0N/A * Also called during de-serialization. 0N/A * @param mask the actions mask to use. 0N/A // store only the canonical cpath if possible 1760N/A // call getCanonicalPath with a path with wildcard character 1760N/A // replaced to avoid calling it with paths that are 1760N/A // intended to match all entries in a directory 0N/A //recursive = false; 0N/A // overkill since they are initialized to false, but 0N/A // commented out here to remind us... 0N/A //directory = false; 0N/A //recursive = false; 0N/A // XXX: at this point the path should be absolute. die if it isn't? 0N/A * Creates a new FilePermission object with the specified actions. 0N/A * <i>path</i> is the pathname of a file or directory, and <i>actions</i> 0N/A * contains a comma-separated list of the desired actions granted on the 0N/A * file or directory. Possible actions are 893N/A * "read", "write", "execute", "delete", and "readlink". 0N/A * <p>A pathname that ends in "/*" (where "/" is 0N/A * the file separator character, <code>File.separatorChar</code>) 0N/A * indicates all the files and directories contained in that directory. 0N/A * A pathname that ends with "/-" indicates (recursively) all files and 0N/A * subdirectories contained in that directory. The special pathname 0N/A * "<<ALL FILES>>" matches any file. 0N/A * <p>A pathname consisting of a single "*" indicates all the files 0N/A * in the current directory, while a pathname consisting of a single "-" 0N/A * indicates all the files in the current directory and 0N/A * (recursively) all files and subdirectories contained in the current 0N/A * <p>A pathname containing an empty string represents an empty path. 0N/A * @param actions the action string. 0N/A * @throws IllegalArgumentException 0N/A * If actions is <code>null</code>, empty or contains an action 0N/A * other than the specified possible actions. 0N/A * Creates a new FilePermission object using an action mask. 0N/A * More efficient than the FilePermission(String, String) constructor. 0N/A * Can be used from within 0N/A * code that needs to create a FilePermission object to pass into the 0N/A * <code>implies</code> method. 0N/A * @param mask the action mask to use. 0N/A // package private for use by the FilePermissionCollection add method 0N/A * Checks if this FilePermission object "implies" the specified permission. 0N/A * More specifically, this method returns true if:<p> 0N/A * <li> <i>p</i> is an instanceof FilePermission,<p> 0N/A * <li> <i>p</i>'s actions are a proper subset of this 0N/A * object's actions, and <p> 0N/A * <li> <i>p</i>'s pathname is implied by this object's 0N/A * pathname. For example, "/tmp/*" implies "/tmp/foo", since 0N/A * "/tmp/*" encompasses all files in the "/tmp" directory, 0N/A * including the one named "foo". 0N/A * @param p the permission to check against. 0N/A * @return <code>true</code> if the specified permission is not 0N/A * <code>null</code> and is implied by this object, 0N/A * <code>false</code> otherwise. 0N/A // we get the effective mask. i.e., the "and" of this and that. 0N/A // They must be equal to that.mask for implies to return true. 0N/A * Checks if the Permission's actions are a proper subset of the 0N/A * this object's actions. Returns the effective mask iff the 0N/A * this FilePermission's path also implies that FilePermission's path. 0N/A * @param that the FilePermission to check against. 0N/A * @param exact return immediately if the masks are not equal 0N/A * @return the effective mask 0N/A // make sure that.path is longer then path so 0N/A // something like /foo/- does not imply /foo 0N/A // if the permission passed in is a directory 0N/A // specification, make sure that a non-recursive 0N/A // permission (i.e., this object) can't imply a recursive 0N/A // this.cpath.equals(that.cpath.substring(0, last+1)); 0N/A // Use regionMatches to avoid creating new string 0N/A * Checks two FilePermission objects for equality. Checks that <i>obj</i> is 0N/A * a FilePermission, and has the same pathname and actions as this object. 0N/A * @param obj the object we are testing for equality with this object. 0N/A * @return <code>true</code> if obj is a FilePermission, and has the same 0N/A * pathname and actions as this FilePermission object, 0N/A * <code>false</code> otherwise. 0N/A * Returns the hash code value for this object. 0N/A * @return a hash code value for this object. 0N/A * Converts an actions String to an actions mask. 0N/A * @param action the action string. 0N/A * @return the actions mask. 0N/A // Null action valid? 0N/A // Check against use of constants (used heavily within the JDK) 0N/A while ((i!=-
1) && ((c = a[i]) ==
' ' ||
0N/A // check for the known strings 0N/A if (i >=
3 && (a[i-
3] ==
'r' || a[i-
3] ==
'R') &&
0N/A (a[i-
2] ==
'e' || a[i-
2] ==
'E') &&
0N/A (a[i-
1] ==
'a' || a[i-
1] ==
'A') &&
0N/A (a[i] ==
'd' || a[i] ==
'D'))
0N/A }
else if (i >=
4 && (a[i-
4] ==
'w' || a[i-
4] ==
'W') &&
0N/A (a[i-
3] ==
'r' || a[i-
3] ==
'R') &&
0N/A (a[i-
2] ==
'i' || a[i-
2] ==
'I') &&
0N/A (a[i-
1] ==
't' || a[i-
1] ==
'T') &&
0N/A (a[i] ==
'e' || a[i] ==
'E'))
0N/A }
else if (i >=
6 && (a[i-
6] ==
'e' || a[i-
6] ==
'E') &&
0N/A (a[i-
5] ==
'x' || a[i-
5] ==
'X') &&
0N/A (a[i-
4] ==
'e' || a[i-
4] ==
'E') &&
0N/A (a[i-
3] ==
'c' || a[i-
3] ==
'C') &&
0N/A (a[i-
2] ==
'u' || a[i-
2] ==
'U') &&
0N/A (a[i-
1] ==
't' || a[i-
1] ==
'T') &&
0N/A (a[i] ==
'e' || a[i] ==
'E'))
0N/A }
else if (i >=
5 && (a[i-
5] ==
'd' || a[i-
5] ==
'D') &&
0N/A (a[i-
4] ==
'e' || a[i-
4] ==
'E') &&
0N/A (a[i-
3] ==
'l' || a[i-
3] ==
'L') &&
0N/A (a[i-
2] ==
'e' || a[i-
2] ==
'E') &&
0N/A (a[i-
1] ==
't' || a[i-
1] ==
'T') &&
0N/A (a[i] ==
'e' || a[i] ==
'E'))
893N/A }
else if (i >=
7 && (a[i-
7] ==
'r' || a[i-
7] ==
'R') &&
893N/A (a[i-
6] ==
'e' || a[i-
6] ==
'E') &&
893N/A (a[i-
5] ==
'a' || a[i-
5] ==
'A') &&
893N/A (a[i-
4] ==
'd' || a[i-
4] ==
'D') &&
893N/A (a[i-
3] ==
'l' || a[i-
3] ==
'L') &&
893N/A (a[i-
2] ==
'i' || a[i-
2] ==
'I') &&
893N/A (a[i-
1] ==
'n' || a[i-
1] ==
'N') &&
893N/A (a[i] ==
'k' || a[i] ==
'K'))
0N/A // make sure we didn't just match the tail of a word 0N/A // like "ackbarfaccept". Also, skip to the comma. 0N/A case ' ':
case '\r':
case '\n':
0N/A case '\f':
case '\t':
0N/A // point i at the location of the comma minus one (or -1). 0N/A * Return the current action mask. Used by the FilePermissionCollection. 0N/A * @return the actions mask. 0N/A * Return the canonical string representation of the actions. 0N/A * Always returns present actions in the following order: 893N/A * read, write, execute, delete, readlink. 0N/A * @return the canonical string representation of the actions. 0N/A * Returns the "canonical string representation" of the actions. 0N/A * That is, this method always returns present actions in the following order: 893N/A * read, write, execute, delete, readlink. For example, if this FilePermission 893N/A * object allows both write and read actions, a call to <code>getActions</code> 0N/A * will return the string "read,write". 0N/A * @return the canonical string representation of the actions. 0N/A * Returns a new PermissionCollection object for storing FilePermission 0N/A * FilePermission objects must be stored in a manner that allows them 0N/A * to be inserted into the collection in any order, but that also enables the 0N/A * PermissionCollection <code>implies</code> 0N/A * method to be implemented in an efficient (and consistent) manner. 0N/A * <p>For example, if you have two FilePermissions: 0N/A * <LI> <code>"/tmp/-", "read"</code> 0N/A * <p>and you are calling the <code>implies</code> method with the FilePermission: 0N/A * then the <code>implies</code> function must 0N/A * permissions, so the effective permission is "read,write", 0N/A * and <code>implies</code> returns true. The "implies" semantics for 0N/A * FilePermissions are handled properly by the PermissionCollection object 0N/A * returned by this <code>newPermissionCollection</code> method. 0N/A * @return a new PermissionCollection object suitable for storing 0N/A * WriteObject is called to save the state of the FilePermission 0N/A * to a stream. The actions are serialized, and the superclass 0N/A * takes care of the name. 0N/A // Write out the actions. The superclass takes care of the name 0N/A // call getActions to make sure actions field is initialized 0N/A * readObject is called to restore the state of the FilePermission from 0N/A // Read in the actions, then restore everything else by calling init. 0N/A * A FilePermissionCollection stores a set of FilePermission permissions. 0N/A * FilePermission objects 0N/A * must be stored in a manner that allows them to be inserted in any 0N/A * order, but enable the implies function to evaluate the implies 0N/A * For example, if you have two FilePermissions: 0N/A * <LI> "/tmp/-", "read" 0N/A * And you are calling the implies function with the FilePermission: 0N/A * permissions, so the effective permission is "read,write". 0N/A * @see java.security.Permission 0N/A * @see java.security.Permissions 0N/A * @see java.security.PermissionCollection 0N/A * @author Marianne Mueller 0N/A * @author Roland Schemers 0N/A // Not serialized; see serialization section at end of class 0N/A * Create an empty FilePermissions object. 0N/A * Adds a permission to the FilePermissions. The key for the hash is 0N/A * @param permission the Permission object to add. 0N/A * @exception IllegalArgumentException - if the permission is not a 0N/A * @exception SecurityException - if this FilePermissionCollection object 0N/A * has been marked readonly 0N/A "attempt to add a Permission to a readonly PermissionCollection");
0N/A synchronized (
this) {
0N/A * Check and see if this set of permissions implies the permissions 0N/A * expressed in "permission". 0N/A * @param p the Permission object to compare 0N/A * @return true if "permission" is a proper subset of a permission in 0N/A * the set, false if not. 0N/A synchronized (
this) {
0N/A for (
int i =
0; i <
len; i++) {
0N/A * Returns an enumeration of all the FilePermission objects in the 0N/A * @return an enumeration of all the FilePermission objects. 0N/A // Convert Iterator into Enumeration 0N/A synchronized (
this) {
0N/A // Need to maintain serialization interoperability with earlier releases, 0N/A // which had the serializable field: 0N/A // private Vector permissions; 0N/A * @serialField permissions java.util.Vector 0N/A * A list of FilePermission objects. 0N/A * @serialData "permissions" field (a Vector containing the FilePermissions). 0N/A * Writes the contents of the perms field out as a Vector for 0N/A * serialization compatibility with earlier releases. 0N/A // Don't call out.defaultWriteObject() 0N/A synchronized (
this) {
0N/A * Reads in a Vector of FilePermissions and saves them in the perms field. 0N/A // Don't call defaultReadObject() 0N/A // Read in serialized fields 0N/A // Get the one we want