package org.dynmap.web.handlers;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;

import org.dynmap.utils.FileLockManager;
import org.dynmap.web.HttpField;
import org.dynmap.web.HttpRequest;
import org.dynmap.web.HttpResponse;


public class FilesystemHandler extends FileHandler {
    private File root;
    public FilesystemHandler(File root) {
        if (!root.isDirectory())
            throw new IllegalArgumentException();
        this.root = root;
    }
    @Override
    protected InputStream getFileInput(String path, HttpRequest request, HttpResponse response) {
        File file = new File(root, path);
        FileLockManager.getReadLock(file);
        if (file.getAbsolutePath().startsWith(root.getAbsolutePath()) && file.isFile()) {
            FileInputStream result;
            try {
                result = new FileInputStream(file);
            } catch (FileNotFoundException e) {
                FileLockManager.releaseReadLock(file);
                return null;
            }
            response.fields.put(HttpField.ContentLength, Long.toString(file.length()));
            return result;
        }
        FileLockManager.releaseReadLock(file);
        return null;
    }
    protected void closeFileInput(String path, InputStream in) throws IOException {
        super.closeFileInput(path, in);
        File file = new File(root, path);
        FileLockManager.releaseReadLock(file);
    }

}

@@ -175,16 +175,39 @@
 tream;%0A%0A
+import org.dynmap.Log;%0A
 import o
@@ -767,32 +767,50 @@
 ReadLock(file);%0A
+        try %7B%0A    
         if (file
@@ -809,32 +809,33 @@
 if (file.get
-Absolute
+Canonical
 Path().start
@@ -892,24 +892,28 @@
             
+    
 FileInputStr
@@ -928,38 +928,46 @@
 lt;%0A            
+  
+  
 try %7B%0A
+    
                 
@@ -1014,16 +1014,20 @@
         
+    
 %7D catch 
@@ -1062,32 +1062,36 @@
                 
+  
+  
 FileLockManager.
@@ -1121,32 +1121,36 @@
                 
+    
 return null;%0A   
@@ -1150,34 +1150,40 @@
 ll;%0A            
-%7D%0A
+    %7D%0A  
             resp
@@ -1178,16 +1178,18 @@
         
+  
 response
@@ -1264,24 +1264,28 @@
             
+    
 return resul
@@ -1279,32 +1279,158 @@
  return result;%0A
+            %7D%0A        %7D catch(IOException ex) %7B%0A            Log.severe(%22Unable to get canoical path of requested file.%22, ex);%0A
         %7D%0A      

Fix Security Exploit