001/* =========================================================== 002 * JFreeChart : a free chart library for the Java(tm) platform 003 * =========================================================== 004 * 005 * (C) Copyright 2000-2013, by Object Refinery Limited and Contributors. 006 * 007 * Project Info: http://www.jfree.org/jfreechart/index.html 008 * 009 * This library is free software; you can redistribute it and/or modify it 010 * under the terms of the GNU Lesser General Public License as published by 011 * the Free Software Foundation; either version 2.1 of the License, or 012 * (at your option) any later version. 013 * 014 * This library is distributed in the hope that it will be useful, but 015 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 016 * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public 017 * License for more details. 018 * 019 * You should have received a copy of the GNU Lesser General Public 020 * License along with this library; if not, write to the Free Software 021 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, 022 * USA. 023 * 024 * [Oracle and Java are registered trademarks of Oracle and/or its affiliates. 025 * Other names may be trademarks of their respective owners.] 026 * 027 * ----------------- 028 * DisplayChart.java 029 * ----------------- 030 * (C) Copyright 2002-2013, by Richard Atkinson and Contributors. 031 * 032 * Original Author: Richard Atkinson; 033 * Contributor(s): David Gilbert (for Object Refinery Limited); 034 * 035 * Changes 036 * ------- 037 * 19-Aug-2002 : Version 1; 038 * 09-Mar-2005 : Added facility to serve up "one time" charts - see 039 * ServletUtilities.java (DG); 040 * ------------- JFREECHART 1.0.x --------------------------------------------- 041 * 02-Feb-2007 : Removed author tags all over JFreeChart sources (DG); 042 * 03-Dec-2011 : Fixed path disclosure vulnerability - see bug 2879650 (DG); 043 * 044 */ 045 046package org.jfree.chart.servlet; 047 048import java.io.File; 049import java.io.IOException; 050 051import javax.servlet.ServletException; 052import javax.servlet.http.HttpServlet; 053import javax.servlet.http.HttpServletRequest; 054import javax.servlet.http.HttpServletResponse; 055import javax.servlet.http.HttpSession; 056 057/** 058 * Servlet used for streaming charts to the client browser from the temporary 059 * directory. You need to add this servlet and mapping to your deployment 060 * descriptor (web.xml) in order to get it to work. The syntax is as follows: 061 * <xmp> 062 * <servlet> 063 * <servlet-name>DisplayChart</servlet-name> 064 * <servlet-class>org.jfree.chart.servlet.DisplayChart</servlet-class> 065 * </servlet> 066 * <servlet-mapping> 067 * <servlet-name>DisplayChart</servlet-name> 068 * <url-pattern>/servlet/DisplayChart</url-pattern> 069 * </servlet-mapping> 070 * </xmp> 071 */ 072public class DisplayChart extends HttpServlet { 073 074 /** 075 * Default constructor. 076 */ 077 public DisplayChart() { 078 super(); 079 } 080 081 /** 082 * Init method. 083 * 084 * @throws ServletException never. 085 */ 086 @Override 087 public void init() throws ServletException { 088 // nothing to do 089 } 090 091 /** 092 * Service method. 093 * 094 * @param request the request. 095 * @param response the response. 096 * 097 * @throws ServletException ??. 098 * @throws IOException ??. 099 */ 100 @Override 101 public void service(HttpServletRequest request, 102 HttpServletResponse response) 103 throws ServletException, IOException { 104 105 HttpSession session = request.getSession(); 106 String filename = request.getParameter("filename"); 107 108 if (filename == null) { 109 throw new ServletException("Parameter 'filename' must be supplied"); 110 } 111 112 // Replace ".." with "" 113 // This is to prevent access to the rest of the file system 114 filename = ServletUtilities.searchReplace(filename, "..", ""); 115 116 // Check the file exists 117 File file = new File(System.getProperty("java.io.tmpdir"), filename); 118 if (!file.exists()) { 119 throw new ServletException( 120 "Unable to display the chart with the filename '" 121 + filename + "'."); 122 } 123 124 // Check that the graph being served was created by the current user 125 // or that it begins with "public" 126 boolean isChartInUserList = false; 127 ChartDeleter chartDeleter = (ChartDeleter) session.getAttribute( 128 "JFreeChart_Deleter"); 129 if (chartDeleter != null) { 130 isChartInUserList = chartDeleter.isChartAvailable(filename); 131 } 132 133 boolean isChartPublic = false; 134 if (filename.length() >= 6) { 135 if (filename.substring(0, 6).equals("public")) { 136 isChartPublic = true; 137 } 138 } 139 140 boolean isOneTimeChart = false; 141 if (filename.startsWith(ServletUtilities.getTempOneTimeFilePrefix())) { 142 isOneTimeChart = true; 143 } 144 145 if (isChartInUserList || isChartPublic || isOneTimeChart) { 146 // Serve it up 147 ServletUtilities.sendTempFile(file, response); 148 if (isOneTimeChart) { 149 file.delete(); 150 } 151 } 152 else { 153 throw new ServletException("Chart image not found"); 154 } 155 } 156 157}