access denied ("java.io.FilePermission" "[file path]" "delete")

Question

I'm facing a problem when trying to delete files I uploaded to my local Tomcat 7 server.

Here's my upload, delete and checkDelete methods :

PS : UploadedFile class is from Primefaces framework

private static final String destination=System.getProperty("user.dir")+"\\GED\\documents\\";

public static boolean uploadToServer(UploadedFile file) {

    boolean done = false;
    try {

        byte[] bytes;

        bytes = file.getContents();
        String filename = FilenameUtils.getName(file.getFileName());
        File dossier = new File(destination);
        dossier.setExecutable(true,true);
        dossier.setReadable(true,true);
        dossier.setWritable(true,true);

        if(!dossier.exists())
            dossier.mkdirs();

        if(dossier.exists())
        {
            BufferedOutputStream stream = new BufferedOutputStream(new FileOutputStream(new File(destination+filename)));
            stream.write(bytes);
            stream.close();

            done = true;
        }
    } catch (IOException e) {
        e.printStackTrace();
    }
    return done;
}

public static boolean deleteFromServer(String fileName) {

    boolean done = false;

    File f = new File(destination+fileName);

        if(f.exists() && f.isFile())
        {
            try {
                done = f.delete();

            } catch (SecurityException e) {
                e.printStackTrace();
            }
        }
    return done;
}

public static boolean checkDelete(String fileName)
{
    SecurityManager manager = new SecurityManager();
    try{
        manager.checkDelete(destination+fileName);
    }
    catch(SecurityException e){
        e.printStackTrace();
        return false;
    }
    return true;
}

before calling my deleteFromServer method, I call the checkDelete method to check if I have the permissions before performing the delete, and I get the following exception message :

java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\apache-tomcat-7.0.68\bin\GED\documents\file.txt" "delete")

I read about modifying the catalina.policy file, but I really couldn't grasp how to do it, and I want a solution which will not cause any security issues in my server.

PS : My application is a JSF web application

EDIT : the full stack trace :

java.security.AccessControlException: access denied ("java.io.FilePermission" "C:\apache-tomcat-7.0.68\bin\GED\documents\pic.jpg" "delete")
at java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.security.AccessController.checkPermission(AccessController.java:884)
at java.lang.SecurityManager.checkPermission(SecurityManager.java:549)
at java.lang.SecurityManager.checkDelete(SecurityManager.java:1007)
at Util.FileManaging.checkDelete(FileManaging.java:71)
at ServiceImpl.DocumentServiceImpl.delete(DocumentServiceImpl.java:206)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157)
at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99)
at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:208)
at com.sun.proxy.$Proxy177.delete(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.el.parser.AstValue.invoke(AstValue.java:279)
at org.apache.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:273)
at org.jboss.weld.util.el.ForwardingMethodExpression.invoke(ForwardingMethodExpression.java:40)
at org.jboss.weld.el.WeldMethodExpression.invoke(WeldMethodExpression.java:50)
at com.sun.faces.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:105)
at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:87)
at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
at javax.faces.component.UICommand.broadcast(UICommand.java:315)
at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:790)
at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:1282)
at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:81)
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:101)
at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:198)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:646)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.primefaces.webapp.filter.FileUploadFilter.doFilter(FileUploadFilter.java:78)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at Util.AuthorizationFilter.doFilter(AuthorizationFilter.java:35)
at org.omnifaces.filter.HttpFilter.doFilter(HttpFilter.java:108)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:220)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:436)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:625)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2517)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2506)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:745)

EDIT, here's the FilePermission I'm using :

java.io.FilePermission "C:/apache-tomcat-7.0.68/bin/GED/documents/-", "delete";

I added the line permission java.io.FilePermission "C:/apache-tomcat-7.0.68/bin/GED/documents/-", "delete"; to java.policy , it doesn't work — Sam, Aug 10 '16 at 09:57
The file permissions when you created the file are set for the owner only. Is it possible that you are trying to delete them using a different user? — Suipaste, Aug 10 '16 at 10:55
No it's the same user, and even when I didn't set the file permissions, I still got the exception — Sam, Aug 10 '16 at 11:15
The `FilePermission` itself looks good, but the key is what you used for your `grant` line in `catalina.policy`. What did you use exactly? Update your question to include the line so it's easier to read than in a comment. — Christopher Schultz, Aug 10 '16 at 12:20
@ChristopherSchultz , `catalina.policy` file contains several grant blocks , I don't know in which one to put the `FilePermission` line , I'll edit my question to include the `FilePermission` line in case there was an error in it — Sam, Aug 10 '16 at 14:28
The surrounding `grant` is critical. Where did you put it for testing? You need to grant that permission to something *specific*. That something specific needs to be *your code*. — Christopher Schultz, Aug 10 '16 at 15:48
@ChristopherSchultz, well should I make my own grant block , or just put the FilePermission line inside an existing one ? I tried putting it inside `grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar"` block, it's not working — Sam, Aug 10 '16 at 16:03
shall I update my question and include the my catalina.policy content ? — Sam, Aug 10 '16 at 16:04
Using an existing `grant` probably won't do what you want. For example, your proposal to use `grant codeBase tomcat-juli.jar` would allow the logging framework to delete your files, but not your actual code. I would recommend doing some research on how the SecurityManager works and how to grant privileges to code. Then go back and modify your `catalina.properties` once you have a better understanding of what's going on. — Christopher Schultz, Aug 10 '16 at 19:16

score 0 · Accepted Answer · answered Aug 11 '16 at 09:39

0

So, I changed my checkDelete method's code to the following :

public static boolean checkDelete(String fileName)
{
    SecurityManager manager = System.getSecurityManager(); //instead of new SecurityManager();
    try{
        if (manager != null)
            manager.checkDelete(destination+fileName);
    }
    catch(SecurityException e){
        e.printStackTrace();
        return false;
    }
    return true;
}

java Doc : https://docs.oracle.com/javase/7/docs/api/java/lang/SecurityManager.html

This method returns true, and my hosted files are deleted from the server without having to modify any catalina file.

answered Aug 11 '16 at 09:39

Sam

605
9
19

So in other words your original `new SecurityManager()` code was completely pointless. – user207421 Aug 11 '16 at 10:06
Well, according to the Java Doc, it's `System.getSecurityManager()` , and it worked well. – Sam Aug 11 '16 at 14:34

access denied ("java.io.FilePermission" "[file path]" "delete")

1 Answers1