apache · halcsi19790320 · Mar 7, 2024 · Jun 21, 2024
diff --git a/src/main/java/org/apache/commons/fileupload/disk/DiskFileItem.java b/src/main/java/org/apache/commons/fileupload/disk/DiskFileItem.java
@@ -18,7 +18,6 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.File;
-import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -35,7 +34,8 @@
 import org.apache.commons.fileupload.util.Streams;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.IOUtils;
-import org.apache.commons.io.output.DeferredFileOutputStream;
+import org.apache.commons.io.output.CipheredDeferredFileOutputStream;
+
 
 /**
  * <p> The default implementation of the
@@ -138,7 +138,7 @@ public class DiskFileItem
     /**
      * Output stream for this item.
      */
-    private transient DeferredFileOutputStream dfos;
+    private transient CipheredDeferredFileOutputStream dfos;
 
     /**
      * The temporary file to use.
@@ -201,7 +201,7 @@ public DiskFileItem(final String fieldName,
     public InputStream getInputStream()
         throws IOException {
         if (!isInMemory()) {
-            return new FileInputStream(dfos.getFile());
+            return dfos.createCipheredInputStream();
         }
 
         if (cachedContent == null) {
@@ -284,7 +284,7 @@ public long getSize() {
         if (dfos.isInMemory()) {
             return dfos.getData().length;
         }
-        return dfos.getFile().length();
+        return dfos.getByteCount();
     }
 
     /**
@@ -308,7 +308,7 @@ public byte[] get() {
         InputStream fis = null;
 
         try {
-            fis = new FileInputStream(dfos.getFile());
+            fis = dfos.createCipheredInputStream();
             IOUtils.readFully(fis, fileData);
         } catch (final IOException e) {
             fileData = null;
@@ -500,7 +500,7 @@ public void setFormField(final boolean state) {
     public OutputStream getOutputStream() throws IOException {
         if (dfos == null) {
             final File outputFile = getTempFile();
-            dfos = new DeferredFileOutputStream(sizeThreshold, outputFile);
+            dfos = new CipheredDeferredFileOutputStream(sizeThreshold, outputFile);
         }
         return dfos;
     }

diff --git a/src/main/java/org/apache/commons/fileupload/util/crypto/CipherServiceProvider.java b/src/main/java/org/apache/commons/fileupload/util/crypto/CipherServiceProvider.java
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.fileupload.util.crypto;
+
+import javax.crypto.Cipher;
+
+/**
+ * Ciphers for temporary file encryption.
+ */
+public interface CipherServiceProvider {
+
+    CipherProvider getCipherProvider();
+
+    interface CipherProvider {
+
+        /**
+         * Cipher for encryption of temporary file.
+         */
+        Cipher getEncryptionCipher();
+
+        /**
+         * Cipher for decryption of temporary file.
+         */
+        Cipher getDecryptionCipher();
+    }
+}
diff --git a/src/main/java/org/apache/commons/fileupload/util/crypto/CipherSpiLoader.java b/src/main/java/org/apache/commons/fileupload/util/crypto/CipherSpiLoader.java
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.commons.fileupload.util.crypto;
+
+import java.util.Iterator;
+import java.util.ServiceLoader;
+
+import org.apache.commons.fileupload.util.crypto.CipherServiceProvider.CipherProvider;
+
+public final class CipherSpiLoader {
+
+    /**
+     * This provider provide consequent enrcyption or decyption cipher. There is no effect, if it is null.
+     */
+    private static CipherServiceProvider cipherServiceProvider;
+
+    static {
+        Iterator<CipherServiceProvider> iterator = ServiceLoader.load(CipherServiceProvider.class)
+        .iterator();
+        if (iterator.hasNext()) {
+            cipherServiceProvider = iterator.next();
+        }
+    }
+
+    private CipherSpiLoader() {
+    }
+
+    public static CipherProvider getCipherProvider() {
+        return cipherServiceProvider == null ? null : cipherServiceProvider.getCipherProvider();
+    }
+
+    public static void changeCipherProvider(CipherServiceProvider myCipherServiceProvider) {
+        cipherServiceProvider = myCipherServiceProvider;
+    }
+}
diff --git a/src/main/java/org/apache/commons/fileupload/util/crypto/package-info.java b/src/main/java/org/apache/commons/fileupload/util/crypto/package-info.java
@@ -0,0 +1,23 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/**
+ * This package contains an interface which provide ciphers for encription
+ * and decription. The Util class load one implementation and wrap input or
+ * outputStreams with cipher.
+ */
+package org.apache.commons.fileupload.util.crypto;