We are conducting a standalone test.
The method returns a file path that matches the first 10 digits of a file name in a directory.
By the way, the sauce looks like this
private String getXmlFormatFilePath(String reportFormatId){
File directory = new File (XML_FILE_PATH);
// Get list of files and only name
File[] fileList=directory.listFiles();
// Get file list information
for (FileFileInfo:fileList) {
String fileName = fileInfo.getName();
// Extracts the first 10 digits of the business form ID and filename that match
if(fileName.startsWith(reportFormatId.substring(0,10)))){
// Return directory path and filename together
return directory + XML_FILE_PATH_KUGIRI+fileName;
}
}
// TODO
US>throw new SystemException(MSG_KEY_SC, "No file matches the first 10 digits of the business form ID and filename");
}
In this case, we will verify that a special character (escape sequence such as \n) is entered in the reportFormatId in the anomaly system.
Is there a new line, a tab, etc. when I name a Windows file?
Personally, I don't think it exists, and if it doesn't, I don't think it's necessary to verify the escape sequence (because it's going to be an error anyway).
What do you think?
Also, there is a function to create a file for the same reason, and if you enter an escape sequence, you will not be able to create it and you will get an error, so what do you think?
Control characters are error in the file path, but if you do not check the allowed string for the reportFormatId of the argument, you will also allow the following values:
../ (folder name or file name in parent folder of destination folder)
There is no problem if the value in reportFormatId is already limited to, for example, "You can only enter a string that you can enter in the business form ID", but this is a similar problem to directory traversal.
You will need to check the values when searching for files.
On Windows, you can also create a file with a name that includes line breaks and tabs.
Cygwin seems to be just using Unicode private space to avoid restrictions.
Test Program:
#include<fstream>
# include <iostream>
int main()
{
const std::string filename("abc\ndef\tghi");
std::ofstream ofs (filename.c_str());
if(ofs){
std::cerr<<"successful\n";
ofs<<"test";
}
else{
std::cerr<<"failed\n";
}
// Close Error Handling Omitted
}
Test Results:
cygwin#clang++-Wall create_file.cpp
cygwin#./a.out
successful
cygwin#ls-labc*
-rw -r --r --1 anon None 4 March 423:04 abc
defghi
cygwin#rmabc*
rm: Do you want to delete the normal file `abc\ndef\tghi'?
Results in cmd.exe:
d:\tmp\stackoverflow\22753>dirabc*
(Omitted)
March 4, 2016 23:044 abc·def·ghi
1 file 4 bytes
Also, even if you can't make it on Windows, there is a possibility that you can make it on another operating system.
I remember making a file on a FAT-formatted floppy disk with a case-sensitive name like "abc.TXT" and "ABC.TXT" on Unix, and confirming that Windows can display a list of files but only open one.
© 2024 OneMinuteCode. All rights reserved.