This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch tomee-10.x in repository https://gitbox.apache.org/repos/asf/tomee.git
commit 5869a49f774fd6d27f5499ec3a75c32cc3c9dbad Author: Markus Jung <[email protected]> AuthorDate: Sat Aug 22 20:30:33 2026 +0200 improve ejb passivation (cherry picked from commit 373307f1999f44a73439cc5170c1503d6a9d845b) --- .../apache/openejb/core/managed/SimplePassivater.java | 18 ++++++++++++------ .../apache/openejb/core/stateful/SimplePassivater.java | 18 ++++++++++++------ 2 files changed, 24 insertions(+), 12 deletions(-) diff --git a/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java b/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java index c6424f9901..784c17bb87 100644 --- a/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java +++ b/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java @@ -72,9 +72,7 @@ public class SimplePassivater implements PassivationStrategy { public void passivate(final Object primaryKey, final Object state) throws SystemException { try { - final String filename = primaryKey.toString().replace(':', '='); - - final File sessionFile = new File(sessionDirectory, filename); + final File sessionFile = sessionFile(primaryKey); if (!sessionFile.exists() && !sessionFile.createNewFile()) { throw new Exception("Failed to create passivation file: " + sessionFile.getAbsolutePath()); } @@ -105,9 +103,7 @@ public class SimplePassivater implements PassivationStrategy { @Override public Object activate(final Object primaryKey) throws SystemException { try { - final String filename = primaryKey.toString().replace(':', '='); - - final File sessionFile = new File(sessionDirectory, filename); + final File sessionFile = sessionFile(primaryKey); if (sessionFile.exists()) { logger.info("Activating from file " + sessionFile); @@ -130,4 +126,14 @@ public class SimplePassivater implements PassivationStrategy { throw new SystemException(t); } } + + private File sessionFile(final Object primaryKey) throws IOException { + final String filename = primaryKey.toString().replace(':', '='); + + final File sessionFile = new File(sessionDirectory, filename).getCanonicalFile(); + if (!sessionDirectory.getCanonicalFile().equals(sessionFile.getParentFile())) { + throw new IOException("Invalid session id: " + filename + " does not resolve to a file directly inside the passivation directory"); + } + return sessionFile; + } } \ No newline at end of file diff --git a/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java b/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java index 21a45a322e..6ef9b6403f 100644 --- a/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java +++ b/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java @@ -77,9 +77,7 @@ public class SimplePassivater implements PassivationStrategy { public void passivate(final Object primaryKey, final Object state) throws SystemException { try { - final String filename = primaryKey.toString().replace(':', '='); - - final File sessionFile = new File(sessionDirectory, filename); + final File sessionFile = sessionFile(primaryKey); logger.info("Passivating to file " + sessionFile); @@ -109,9 +107,7 @@ public class SimplePassivater implements PassivationStrategy { @Override public Object activate(final Object primaryKey) throws SystemException { try { - final String filename = primaryKey.toString().replace(':', '='); - - final File sessionFile = new File(sessionDirectory, filename); + final File sessionFile = sessionFile(primaryKey); if (sessionFile.exists()) { logger.info("Activating from file " + sessionFile); @@ -134,4 +130,14 @@ public class SimplePassivater implements PassivationStrategy { throw new SystemException(t); } } + + private File sessionFile(final Object primaryKey) throws IOException { + final String filename = primaryKey.toString().replace(':', '='); + + final File sessionFile = new File(sessionDirectory, filename).getCanonicalFile(); + if (!sessionDirectory.getCanonicalFile().equals(sessionFile.getParentFile())) { + throw new IOException("Invalid session id: " + filename + " does not resolve to a file directly inside the passivation directory"); + } + return sessionFile; + } } \ No newline at end of file
