[DS-707] Security fixes

git-svn-id: http://scm.dspace.org/svn/repo/dspace/trunk@5625 9c30dcfa-912a-0410-8fc2-9e0234be79fd
This commit is contained in:
Graham Triggs
2010-10-24 23:21:21 +00:00
parent 7f5088d4df
commit e5cc6f3adc
18 changed files with 91 additions and 98 deletions

View File

@@ -39,10 +39,11 @@
package org.dspace.app.bulkedit; package org.dspace.app.bulkedit;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Hashtable; import java.util.HashMap;
import java.util.Enumeration;
import java.util.Iterator; import java.util.Iterator;
import java.util.List; import java.util.List;
import java.util.Map;
import java.util.Set;
/** /**
* Utility class to store a line from a CSV file * Utility class to store a line from a CSV file
@@ -55,7 +56,7 @@ public class DSpaceCSVLine
private int id; private int id;
/** The elements in this line in a hashtable, keyed by the metadata type */ /** The elements in this line in a hashtable, keyed by the metadata type */
private Hashtable<String, ArrayList> items; private Map<String, ArrayList> items;
/** /**
* Create a new CSV line * Create a new CSV line
@@ -66,7 +67,7 @@ public class DSpaceCSVLine
{ {
// Store the ID + separator, and initialise the hashtable // Store the ID + separator, and initialise the hashtable
this.id = id; this.id = id;
items = new Hashtable<String, ArrayList>(); items = new HashMap<String, ArrayList>();
} }
/** /**
@@ -76,7 +77,7 @@ public class DSpaceCSVLine
{ {
// Set the ID to be -1, and initialise the hashtable // Set the ID to be -1, and initialise the hashtable
this.id = -1; this.id = -1;
this.items = new Hashtable<String, ArrayList>(); this.items = new HashMap<String, ArrayList>();
} }
/** /**
@@ -128,10 +129,10 @@ public class DSpaceCSVLine
* *
* @return An enumeration of all the keys * @return An enumeration of all the keys
*/ */
public Enumeration<String> keys() public Set<String> keys()
{ {
// Return the keys // Return the keys
return items.keys(); return items.keySet();
} }
/** /**

View File

@@ -48,7 +48,6 @@ import org.dspace.eperson.EPerson;
import org.dspace.workflow.WorkflowManager; import org.dspace.workflow.WorkflowManager;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Enumeration;
import java.io.File; import java.io.File;
import java.io.InputStreamReader; import java.io.InputStreamReader;
import java.io.BufferedReader; import java.io.BufferedReader;
@@ -137,11 +136,9 @@ public class MetadataImport
} }
// Iterate through each metadata element in the csv line // Iterate through each metadata element in the csv line
Enumeration<String> e = line.keys(); for (String md : line.keys())
while (e.hasMoreElements())
{ {
// Get the values we already have // Get the values we already have
String md = e.nextElement();
if (!"id".equals(md)) if (!"id".equals(md))
{ {
// Get the values from the CSV // Get the values from the CSV
@@ -169,12 +166,10 @@ public class MetadataImport
} }
// Iterate through each metadata element in the csv line // Iterate through each metadata element in the csv line
Enumeration<String> e = line.keys();
BulkEditChange whatHasChanged = new BulkEditChange(); BulkEditChange whatHasChanged = new BulkEditChange();
while (e.hasMoreElements()) for (String md : line.keys())
{ {
// Get the values we already have // Get the values we already have
String md = e.nextElement();
if (!"id".equals(md)) if (!"id".equals(md))
{ {
// Get the values from the CSV // Get the values from the CSV

View File

@@ -210,7 +210,7 @@ public class HTMLReport implements Report
*/ */
public void setStartDate(Date start) public void setStartDate(Date start)
{ {
this.start = start; this.start = start == null ? null : (Date)start.clone();
} }
@@ -221,7 +221,7 @@ public class HTMLReport implements Report
*/ */
public void setEndDate(Date end) public void setEndDate(Date end)
{ {
this.end = end; this.end = end == null ? null : (Date)end.clone();
} }

View File

@@ -148,9 +148,9 @@ public final class BitstreamInfo
nm, ""); nm, "");
this.deleted = del; this.deleted = del;
this.processEndDate = procEndDate; this.processEndDate = processEndDate == null ? null : (Date)procEndDate.clone();
this.toBeProcessed = toBeProc; this.toBeProcessed = toBeProc;
this.processStartDate = procStartDate; this.processStartDate = processStartDate == null ? null : (Date)procStartDate.clone();
this.infoFound = true; this.infoFound = true;
} }
@@ -529,7 +529,7 @@ public final class BitstreamInfo
*/ */
public Date getProcessStartDate() public Date getProcessStartDate()
{ {
return this.processStartDate; return this.processStartDate == null ? null : (Date)this.processStartDate.clone();
} }
/** /**
@@ -540,7 +540,7 @@ public final class BitstreamInfo
*/ */
public void setProcessStartDate(Date startDate) public void setProcessStartDate(Date startDate)
{ {
this.processStartDate = startDate; this.processStartDate = startDate == null ? null : (Date)startDate.clone();
} }
/** /**
@@ -550,7 +550,7 @@ public final class BitstreamInfo
*/ */
public Date getProcessEndDate() public Date getProcessEndDate()
{ {
return this.processEndDate; return this.processEndDate == null ? null : (Date)this.processEndDate.clone();
} }
/** /**
@@ -561,6 +561,6 @@ public final class BitstreamInfo
*/ */
public void setProcessEndDate(Date endDate) public void setProcessEndDate(Date endDate)
{ {
this.processEndDate = endDate; this.processEndDate = endDate == null ? null : (Date)endDate.clone();
} }
} }

View File

@@ -423,7 +423,7 @@ public final class CheckerCommand
*/ */
public Date getProcessStartDate() public Date getProcessStartDate()
{ {
return processStartDate; return processStartDate == null ? null : (Date)processStartDate.clone();
} }
/** /**
@@ -434,7 +434,7 @@ public final class CheckerCommand
*/ */
public void setProcessStartDate(Date startDate) public void setProcessStartDate(Date startDate)
{ {
processStartDate = startDate; processStartDate = startDate == null ? null : (Date)startDate.clone();
} }
/** /**

View File

@@ -99,8 +99,8 @@ public class ChecksumHistory
String checksumExpted, String checksumCalc, String inResult) String checksumExpted, String checksumCalc, String inResult)
{ {
this.bitstreamId = bitstrmId; this.bitstreamId = bitstrmId;
this.processStartDate = startDate; this.processStartDate = startDate == null ? null : (Date)startDate.clone();
this.processEndDate = endDate; this.processEndDate = endDate == null ? null : (Date)endDate.clone();
this.checksumExpected = checksumExpted; this.checksumExpected = checksumExpted;
this.checksumCalculated = checksumCalc; this.checksumCalculated = checksumCalc;
this.result = inResult; this.result = inResult;
@@ -161,7 +161,7 @@ public class ChecksumHistory
*/ */
public Date getProcessEndDate() public Date getProcessEndDate()
{ {
return processEndDate; return processEndDate == null ? null : (Date)processEndDate.clone();
} }
/** /**
@@ -172,7 +172,7 @@ public class ChecksumHistory
*/ */
public void setProcessEndDate(Date processEndDate) public void setProcessEndDate(Date processEndDate)
{ {
this.processEndDate = processEndDate; this.processEndDate = processEndDate == null ? null : (Date)processEndDate.clone();
} }
/** /**
@@ -183,7 +183,7 @@ public class ChecksumHistory
*/ */
public Date getProcessStartDate() public Date getProcessStartDate()
{ {
return processStartDate; return processStartDate == null ? null : (Date)processStartDate.clone();
} }
/** /**
@@ -195,7 +195,7 @@ public class ChecksumHistory
*/ */
public void setProcessStartDate(Date processStartDate) public void setProcessStartDate(Date processStartDate)
{ {
this.processStartDate = processStartDate; this.processStartDate = processStartDate == null ? null : (Date)processStartDate.clone();
} }
/** /**

View File

@@ -69,11 +69,10 @@ public class SimpleDispatcher implements BitstreamDispatcher
* indicates whether checker should loop infinitely through * indicates whether checker should loop infinitely through
* most_recent_checksum table * most_recent_checksum table
*/ */
public SimpleDispatcher(BitstreamInfoDAO bitstreamInfoDAO, Date startTime, public SimpleDispatcher(BitstreamInfoDAO bitstreamInfoDAO, Date startTime, boolean looping)
boolean looping)
{ {
this.bitstreamInfoDAO = bitstreamInfoDAO; this.bitstreamInfoDAO = bitstreamInfoDAO;
this.processStartTime = startTime; this.processStartTime = startTime == null ? null : (Date)startTime.clone();
this.loopContinuously = looping; this.loopContinuously = looping;
} }

View File

@@ -610,5 +610,14 @@ public class Context
{ {
abort(); abort();
} }
try
{
super.finalize();
}
catch (Throwable t)
{
log.error("Unable to finalize object", t);
}
} }
} }

View File

@@ -39,6 +39,8 @@
*/ */
package org.dspace.storage.rdbms; package org.dspace.storage.rdbms;
import org.apache.log4j.Logger;
import java.sql.ResultSet; import java.sql.ResultSet;
import java.sql.SQLException; import java.sql.SQLException;
import java.sql.Statement; import java.sql.Statement;
@@ -53,6 +55,7 @@ import java.util.List;
*/ */
public class TableRowIterator public class TableRowIterator
{ {
private final static Logger log = Logger.getLogger(TableRowIterator.class);
/** /**
* Results from a query * Results from a query
*/ */
@@ -111,6 +114,15 @@ public class TableRowIterator
protected void finalize() protected void finalize()
{ {
close(); close();
try
{
super.finalize();
}
catch (Throwable t)
{
log.error("Unable to finalize object", t);
}
} }
/** /**

View File

@@ -35,9 +35,9 @@ package org.dspace.app.webui.jsptag;
import java.io.File; import java.io.File;
import java.io.FilenameFilter; import java.io.FilenameFilter;
import java.util.Enumeration; import java.util.HashMap;
import java.util.Hashtable;
import java.util.Iterator; import java.util.Iterator;
import java.util.Map;
import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequest;
import javax.servlet.jsp.JspException; import javax.servlet.jsp.JspException;
@@ -73,7 +73,7 @@ public class ControlledVocabularyTag extends TagSupport
private String vocabulary; private String vocabulary;
// an hashtable containing all the loaded vocabularies // an hashtable containing all the loaded vocabularies
public Hashtable controlledVocabularies; public Map<String, Document> controlledVocabularies;
/** /**
* Process tag * Process tag
@@ -95,27 +95,23 @@ public class ControlledVocabularyTag extends TagSupport
+ "vocabulary2html.xsl"; + "vocabulary2html.xsl";
// Load vocabularies on startup // Load vocabularies on startup
controlledVocabularies = (Hashtable) pageContext.getServletContext() controlledVocabularies = (Map<String, Document>) pageContext.getServletContext().getAttribute("controlledvocabulary.controlledVocabularies");
.getAttribute("controlledvocabulary.controlledVocabularies");
if (controlledVocabularies == null) if (controlledVocabularies == null)
{ {
controlledVocabularies = loadControlledVocabularies(vocabulariesPath); controlledVocabularies = loadControlledVocabularies(vocabulariesPath);
pageContext.getServletContext().setAttribute( pageContext.getServletContext().setAttribute("controlledvocabulary.controlledVocabularies", controlledVocabularies);
"controlledvocabulary.controlledVocabularies",
controlledVocabularies);
} }
try try
{ {
Hashtable prunnedVocabularies = needsFiltering() ? filterVocabularies( Map<String, Document> prunnedVocabularies = needsFiltering() ?
controlledVocabularies, vocabularyPrunningXSLT) filterVocabularies(controlledVocabularies, vocabularyPrunningXSLT)
: controlledVocabularies; : controlledVocabularies;
String html = ""; String html = "";
if (vocabulary != null && !vocabulary.equals("")) if (vocabulary != null && !vocabulary.equals(""))
{ {
html = renderVocabularyAsHTML((Document) prunnedVocabularies html = renderVocabularyAsHTML(prunnedVocabularies.get(vocabulary + ".xml"),
.get(vocabulary + ".xml"),
controlledVocabulary2HtmlXSLT, controlledVocabulary2HtmlXSLT,
isAllowMultipleSelection(), request.getContextPath()); isAllowMultipleSelection(), request.getContextPath());
} }
@@ -171,14 +167,14 @@ public class ControlledVocabularyTag extends TagSupport
* The context path * The context path
* @return the HTML that represents the vocabularies * @return the HTML that represents the vocabularies
*/ */
private String renderVocabulariesAsHTML(Hashtable vocabularies, private String renderVocabulariesAsHTML(Map<String, Document> vocabularies,
String xslt, boolean allowMultipleSelection, String contextPath) String xslt, boolean allowMultipleSelection, String contextPath)
{ {
StringBuilder result = new StringBuilder(); StringBuilder result = new StringBuilder();
Iterator iter = vocabularies.values().iterator(); Iterator<Document> iter = vocabularies.values().iterator();
while (iter.hasNext()) while (iter.hasNext())
{ {
Document controlledVocabularyXML = (Document) iter.next(); Document controlledVocabularyXML = iter.next();
result.append(renderVocabularyAsHTML(controlledVocabularyXML, xslt, result.append(renderVocabularyAsHTML(controlledVocabularyXML, xslt,
allowMultipleSelection, contextPath)); allowMultipleSelection, contextPath));
} }
@@ -196,18 +192,12 @@ public class ControlledVocabularyTag extends TagSupport
* the filename of the stylesheet that trimms the taxonomies * the filename of the stylesheet that trimms the taxonomies
* @return An hashtable with all the filtered vocabularies * @return An hashtable with all the filtered vocabularies
*/ */
private Hashtable filterVocabularies(Hashtable vocabularies, private Map<String, Document> filterVocabularies(Map<String, Document> vocabularies, String vocabularyPrunningXSLT)
String vocabularyPrunningXSLT)
{ {
Hashtable prunnedVocabularies = new Hashtable(); Map<String, Document> prunnedVocabularies = new HashMap<String, Document>();
Enumeration enumeration = vocabularies.keys(); for (Map.Entry<String, Document> entry : vocabularies.entrySet())
while (enumeration.hasMoreElements())
{ {
String controlledVocabularyKey = (String) enumeration.nextElement(); prunnedVocabularies.put(entry.getKey(), filterVocabulary(entry.getValue(), vocabularyPrunningXSLT, getFilter()));
Document controlledVocabulary = (Document) vocabularies
.get(controlledVocabularyKey);
prunnedVocabularies.put(controlledVocabularyKey, filterVocabulary(
controlledVocabulary, vocabularyPrunningXSLT, getFilter()));
} }
return prunnedVocabularies; return prunnedVocabularies;
} }
@@ -239,12 +229,10 @@ public class ControlledVocabularyTag extends TagSupport
try try
{ {
Hashtable parameters = new Hashtable(); Map<String, String> parameters = new HashMap<String, String>();
parameters.put("allowMultipleSelection", parameters.put("allowMultipleSelection", allowMultipleSelection ? "yes" : "no");
allowMultipleSelection ? "yes" : "no");
parameters.put("contextPath", contextPath); parameters.put("contextPath", contextPath);
result = XMLUtil.transformDocumentAsString(vocabulary, parameters, result = XMLUtil.transformDocumentAsString(vocabulary, parameters, controlledVocabulary2HtmlXSLT);
controlledVocabulary2HtmlXSLT);
} }
catch (Exception e) catch (Exception e)
{ {
@@ -265,8 +253,7 @@ public class ControlledVocabularyTag extends TagSupport
* The filter to be applied * The filter to be applied
* @return The trimmed vocabulary. * @return The trimmed vocabulary.
*/ */
public Document filterVocabulary(Document vocabulary, public Document filterVocabulary(Document vocabulary, String vocabularyPrunningXSLT, String filter)
String vocabularyPrunningXSLT, String filter)
{ {
if (vocabulary == null) if (vocabulary == null)
{ {
@@ -275,10 +262,9 @@ public class ControlledVocabularyTag extends TagSupport
try try
{ {
Hashtable parameters = new Hashtable(); Map<String, String> parameters = new HashMap<String, String>();
parameters.put("filter", filter); parameters.put("filter", filter);
Document prunnedVocabulary = XMLUtil.transformDocument(vocabulary, Document prunnedVocabulary = XMLUtil.transformDocument(vocabulary, parameters, vocabularyPrunningXSLT);
parameters, vocabularyPrunningXSLT);
return prunnedVocabulary; return prunnedVocabulary;
} }
catch (Exception e) catch (Exception e)
@@ -298,9 +284,9 @@ public class ControlledVocabularyTag extends TagSupport
* @return an hashtable with the filenames of the vocabularies as keys and * @return an hashtable with the filenames of the vocabularies as keys and
* the XML documents representing the vocabularies as values. * the XML documents representing the vocabularies as values.
*/ */
private static Hashtable loadControlledVocabularies(String directory) private static Map<String, Document> loadControlledVocabularies(String directory)
{ {
Hashtable controlledVocabularies = new Hashtable(); Map<String, Document> controlledVocabularies = new HashMap<String, Document>();
File dir = new File(directory); File dir = new File(directory);
FilenameFilter filter = new FilenameFilter() FilenameFilter filter = new FilenameFilter()
@@ -320,8 +306,7 @@ public class ControlledVocabularyTag extends TagSupport
try try
{ {
Document controlledVocabulary = XMLUtil.loadXML(directory Document controlledVocabulary = XMLUtil.loadXML(directory + filename);
+ filename);
controlledVocabularies.put(filename, controlledVocabulary); controlledVocabularies.put(filename, controlledVocabulary);
log.warn("Loaded vocabulary: " + filename); log.warn("Loaded vocabulary: " + filename);
} }

View File

@@ -47,6 +47,7 @@ import javax.servlet.jsp.JspWriter;
import javax.servlet.jsp.jstl.fmt.LocaleSupport; import javax.servlet.jsp.jstl.fmt.LocaleSupport;
import javax.servlet.jsp.tagext.TagSupport; import javax.servlet.jsp.tagext.TagSupport;
import org.apache.commons.lang.ArrayUtils;
import org.dspace.eperson.EPerson; import org.dspace.eperson.EPerson;
/** /**
@@ -119,7 +120,7 @@ public class SelectEPersonTag extends TagSupport
} }
else if (e instanceof EPerson[]) else if (e instanceof EPerson[])
{ {
epeople = (EPerson[]) e; epeople = (EPerson[])ArrayUtils.clone((EPerson[])e);
} }
} }

View File

@@ -48,6 +48,7 @@ import javax.servlet.jsp.JspWriter;
import javax.servlet.jsp.jstl.fmt.LocaleSupport; import javax.servlet.jsp.jstl.fmt.LocaleSupport;
import javax.servlet.jsp.tagext.TagSupport; import javax.servlet.jsp.tagext.TagSupport;
import org.apache.commons.lang.ArrayUtils;
import org.dspace.eperson.Group; import org.dspace.eperson.Group;
/** /**
@@ -114,7 +115,7 @@ public class SelectGroupTag extends TagSupport
} }
else if(g instanceof Group[]) else if(g instanceof Group[])
{ {
groups = (Group[]) g; groups = (Group[])ArrayUtils.clone((Group[]) g);
} }
} }

View File

@@ -88,7 +88,7 @@ public class EditProfileServlet extends DSpaceServlet
// Find out if they're trying to set a new password // Find out if they're trying to set a new password
boolean settingPassword = false; boolean settingPassword = false;
if (eperson.getRequireCertificate() == false && !StringUtils.isEmpty(request.getParameter("password"))) if (!eperson.getRequireCertificate() && !StringUtils.isEmpty(request.getParameter("password")))
{ {
settingPassword = true; settingPassword = true;
} }

View File

@@ -45,7 +45,6 @@ import java.net.URLEncoder;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.HashMap; import java.util.HashMap;
import java.util.Iterator;
import java.util.List; import java.util.List;
import java.util.Map; import java.util.Map;

View File

@@ -38,6 +38,7 @@ import java.io.IOException;
import java.io.StringWriter; import java.io.StringWriter;
import java.util.Enumeration; import java.util.Enumeration;
import java.util.Hashtable; import java.util.Hashtable;
import java.util.Map;
import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.DocumentBuilderFactory;
@@ -109,8 +110,7 @@ public class XMLUtil
* @return the transformed xml document * @return the transformed xml document
* @throws Exception * @throws Exception
*/ */
public static Document transformDocument(Document xmlDocument, public static Document transformDocument(Document xmlDocument, Map<String, String> parameters, String xsltFilename) throws Exception
Hashtable parameters, String xsltFilename) throws Exception
{ {
// Generate a Transformer. // Generate a Transformer.
@@ -120,12 +120,9 @@ public class XMLUtil
// set transformation parameters // set transformation parameters
if (parameters != null) if (parameters != null)
{ {
Enumeration keys = parameters.keys(); for (Map.Entry<String, String> param : parameters.entrySet())
while (keys.hasMoreElements())
{ {
String key = (String) keys.nextElement(); transformer.setParameter(param.getKey(), param.getValue());
String value = (String) parameters.get(key);
transformer.setParameter(key, value);
} }
} }
@@ -158,8 +155,7 @@ public class XMLUtil
* @return the transformed xml document as a string * @return the transformed xml document as a string
* @throws Exception * @throws Exception
*/ */
public static String transformDocumentAsString(Document xmlDocument, public static String transformDocumentAsString(Document xmlDocument, Map<String, String> parameters, String xsltFilename) throws Exception
Hashtable parameters, String xsltFilename) throws Exception
{ {
// Generate a Transformer. // Generate a Transformer.
@@ -169,14 +165,10 @@ public class XMLUtil
// set transformation parameters // set transformation parameters
if (parameters != null) if (parameters != null)
{ {
Enumeration keys = parameters.keys(); for (Map.Entry<String, String> param : parameters.entrySet())
while (keys.hasMoreElements())
{ {
String key = (String) keys.nextElement(); transformer.setParameter(param.getKey(), param.getValue());
String value = (String) parameters.get(key);
transformer.setParameter(key, value);
} }
} }
StringWriter stringWriter = new StringWriter(); StringWriter stringWriter = new StringWriter();

View File

@@ -134,19 +134,19 @@ public class DatasetTimeGenerator extends DatasetGenerator {
} }
public Date getActualStartDate() { public Date getActualStartDate() {
return actualStartDate; return actualStartDate == null ? null : (Date)actualStartDate.clone();
} }
public void setActualStartDate(Date actualStartDate) { public void setActualStartDate(Date actualStartDate) {
this.actualStartDate = actualStartDate; this.actualStartDate = actualStartDate == null ? null : (Date)actualStartDate.clone();
} }
public Date getActualEndDate() { public Date getActualEndDate() {
return actualEndDate; return actualEndDate == null ? null : (Date)actualEndDate.clone();
} }
public void setActualEndDate(Date actualEndDate) { public void setActualEndDate(Date actualEndDate) {
this.actualEndDate = actualEndDate; this.actualEndDate = actualEndDate == null ? null : (Date)actualEndDate.clone();
} }
public void setDateType(String dateType) { public void setDateType(String dateType) {

View File

@@ -47,14 +47,14 @@ public class StatisticsSolrDateFilter implements StatisticsFilter {
* Must be paired with {@link #setEndDate(Date)}. * Must be paired with {@link #setEndDate(Date)}.
*/ */
public void setStartDate(Date startDate) { public void setStartDate(Date startDate) {
this.startDate = startDate; this.startDate = startDate == null ? null : (Date)startDate.clone();
} }
/** Set the end date as a Date object. /** Set the end date as a Date object.
* Must be paired with {@link #setStartDate(Date)}. * Must be paired with {@link #setStartDate(Date)}.
*/ */
public void setEndDate(Date endDate) { public void setEndDate(Date endDate) {
this.endDate = endDate; this.endDate = endDate == null ? null : (Date)endDate.clone();
} }
/** Convert the date range to a filter expression. /** Convert the date range to a filter expression.

View File

@@ -44,7 +44,6 @@ import java.io.IOException;
import java.sql.SQLException; import java.sql.SQLException;
import java.util.ArrayList; import java.util.ArrayList;
import java.util.Arrays; import java.util.Arrays;
import java.util.Iterator;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;