Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

File blocking refactor #150

Merged
merged 2 commits into from
Mar 29, 2024
Merged

File blocking refactor #150

merged 2 commits into from
Mar 29, 2024

Conversation

brachy84
Copy link
Member

The current system is flawed:

  • changing the security manager before and after each script and closure execution
  • sometimes errors on things reading files from gradle cache

This removes the sketchy security manager. Instead we

  • ban java.io, java.nio.file and java.nio.channels
  • create a wrapper class for java.io.File
  • add most convenience methods from groovy to it
  • redirect File() ctor to GroovyFile() ctor (the wrapper).

The file wrapper resolves the given path to minecraft home path and then checks if the file really is in minecraft home.
Then on each read/write method we check accessability and crash if we cant access.
Just creating the file will not error. Only until you want to read or write the file. Users can check accessibility with .isAccessible() or canRead()/canWrite(). exists() is always safe to call and ignores accessibility.

With this we make file blocking future proof (since modern java will remove security manager) without any performance concerns.
Of course there are still ways to bypass this, but being 100% save is not possible anyways.

@brachy84 brachy84 merged commit c1a68ac into master Mar 29, 2024
1 check passed
@brachy84 brachy84 deleted the file-blocking-refactor branch March 29, 2024 10:46
@brachy84 brachy84 added bug Something isn't working enhancement New feature or request sandbox For internal changes to the sandbox labels Apr 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working enhancement New feature or request sandbox For internal changes to the sandbox
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant