FileSystemStorageService.java

package com.microfocus.example.service;

import java.io.IOException;
import java.io.InputStream;
import java.net.MalformedURLException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.nio.file.StandardCopyOption;
import java.util.List;
import java.util.Objects;
import java.util.stream.Stream;

import com.microfocus.example.config.StorageProperties;
import com.microfocus.example.exception.StorageException;
import com.microfocus.example.exception.StorageFileNotFoundException;
import org.apache.tika.Tika;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.io.Resource;
import org.springframework.core.io.UrlResource;
import org.springframework.stereotype.Service;
import org.springframework.util.FileSystemUtils;
import org.springframework.web.multipart.MultipartFile;

@Service
public class FileSystemStorageService implements StorageService {

    private static final Logger log = LoggerFactory.getLogger(FileSystemStorageService.class);

    private final Path rootLocation;

    @Autowired
    public FileSystemStorageService(StorageProperties properties) {
        this.rootLocation = Paths.get(properties.getLocation());
        if (!Files.exists(this.rootLocation)) {
            log.debug("Creating storage service directory: " + rootLocation.toString());
            try {
                Files.createDirectory(rootLocation);
            } catch (IOException e) {
                e.printStackTrace();
            }
        }
    }

    @Override
    public void store(MultipartFile file) {
        try {
            if (file.isEmpty()) {
                throw new StorageException("Failed to store empty file.");
            }
            Path destinationFile = this.rootLocation.resolve(
                    Paths.get(file.getOriginalFilename()))
                    .normalize().toAbsolutePath();
            if (!destinationFile.getParent().equals(this.rootLocation.toAbsolutePath())) {
                // This is a security check
                throw new StorageException(
                        "Cannot store file outside current directory.");
            }
            try (InputStream inputStream = file.getInputStream()) {
                Files.copy(inputStream, destinationFile,
                        StandardCopyOption.REPLACE_EXISTING);
            }
        }
        catch (IOException e) {
            throw new StorageException("Failed to store file.", e);
        }
    }

	@Override
	public void store(Path path, String dstFileName) {
        try {
            if (Objects.isNull(path) || path.toFile().length() < 1L) {
                throw new StorageException("Failed to store empty file.");
            }

            Path destinationFile = Paths.get(dstFileName)
                    .normalize().toAbsolutePath();

            if (!destinationFile.getParent().equals(this.rootLocation.toAbsolutePath())) {
                // This is a security check
                throw new StorageException(
                        "Cannot store file outside current directory.");
            }
                        
            try (InputStream inputStream = Files.newInputStream(path)) {
                Files.copy(inputStream, destinationFile,
                        StandardCopyOption.REPLACE_EXISTING);
            }
        }
        catch (IOException e) {
            throw new StorageException("Failed to store file.", e);
        }		
	}

    private boolean checkMimeType(Path p, List<String> mimeTypeList) {
    	Tika tika = new Tika();
    	String fileMimeType = "";
		try {
			fileMimeType = tika.detect(p.toFile());
		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
    	if (mimeTypeList.contains(fileMimeType)) 
    		return true;
    	
    	return false;
    	
    }
    
    
    @Override
    public Stream<Path> loadAll(List<String> mimeTypeList) {
        try {
            return Files.walk(this.rootLocation, 1)
                    .filter(path -> !path.equals(this.rootLocation))
                    .filter(path -> checkMimeType(path, mimeTypeList))
                    .map(this.rootLocation::relativize);
        }
        catch (IOException e) {
            throw new StorageException("Failed to read stored files", e);
        }

    }

    @Override
    public Stream<Path> loadAll() {
        try {
            return Files.walk(this.rootLocation, 1)
                    .filter(path -> !path.equals(this.rootLocation))
                    .map(this.rootLocation::relativize);
        }
        catch (IOException e) {
            throw new StorageException("Failed to read stored files", e);
        }

    }

    @Override
    public Path load(String filename) {
        Path resolvedPath = rootLocation.resolve(filename).normalize().toAbsolutePath();
        if (!resolvedPath.getParent().equals(this.rootLocation.toAbsolutePath())) {
            throw new StorageException("Cannot access file outside current directory.");
        }
        return resolvedPath;
    }

    @Override
    public Resource loadAsResource(String filename) {
        return loadAsResource(filename, false);
    }
    
    /*
     * To expose OWASP A01:2021 - Broken Access Control
     */
    @Override
    public Resource loadAsResource(String filename, boolean traverse) {
        try {
            Path file = null; 
            if (traverse) {
                file = rootLocation.resolve(filename).normalize();
                if (!file.startsWith(rootLocation.toAbsolutePath().normalize())) {
                    throw new StorageException("Cannot access file outside current directory.");
                }
            } else { 
                file = load(filename);
            }
            
            Resource resource = new UrlResource(file.toUri());
            if (resource.exists() || resource.isReadable()) {
                return resource;
            }
            else {
                throw new StorageFileNotFoundException(
                        "Could not read file: " + filename);

            }
        }
        catch (MalformedURLException e) {
            throw new StorageFileNotFoundException("Could not read file: " + filename, e);
        }   	
    }
    
    @Override
    public void deleteAll() {
        FileSystemUtils.deleteRecursively(rootLocation.toFile());
    }

    @Override
    public void init() {
        try {
            Files.createDirectories(rootLocation);
        }
        catch (IOException e) {
            throw new StorageException("Could not initialize storage", e);
        }
    }
}