(tomee) branch main updated: improve ejb passivation

[jungm]

This is an automated email from the ASF dual-hosted git repository.

jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git


The following commit(s) were added to refs/heads/main by this push:
     new 373307f199 improve ejb passivation
373307f199 is described below

commit 373307f1999f44a73439cc5170c1503d6a9d845b
Author: Markus Jung <ju...@apache.org>
AuthorDate: Sat Aug 22 20:30:33 2026 +0200

    improve ejb passivation
---
 .../apache/openejb/core/managed/SimplePassivater.java  | 18 ++++++++++++------
 .../apache/openejb/core/stateful/SimplePassivater.java | 18 ++++++++++++------
 2 files changed, 24 insertions(+), 12 deletions(-)

diff --git 
a/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java
 
b/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java
index c6424f9901..784c17bb87 100644
--- 
a/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java
+++ 
b/container/openejb-core/src/main/java/org/apache/openejb/core/managed/SimplePassivater.java
@@ -72,9 +72,7 @@ public class SimplePassivater implements PassivationStrategy {
 
     public void passivate(final Object primaryKey, final Object state) throws 
SystemException {
         try {
-            final String filename = primaryKey.toString().replace(':', '=');
-
-            final File sessionFile = new File(sessionDirectory, filename);
+            final File sessionFile = sessionFile(primaryKey);
             if (!sessionFile.exists() && !sessionFile.createNewFile()) {
                 throw new Exception("Failed to create passivation file: " + 
sessionFile.getAbsolutePath());
             }
@@ -105,9 +103,7 @@ public class SimplePassivater implements 
PassivationStrategy {
     @Override
     public Object activate(final Object primaryKey) throws SystemException {
         try {
-            final String filename = primaryKey.toString().replace(':', '=');
-
-            final File sessionFile = new File(sessionDirectory, filename);
+            final File sessionFile = sessionFile(primaryKey);
 
             if (sessionFile.exists()) {
                 logger.info("Activating from file " + sessionFile);
@@ -130,4 +126,14 @@ public class SimplePassivater implements 
PassivationStrategy {
             throw new SystemException(t);
         }
     }
+
+    private File sessionFile(final Object primaryKey) throws IOException {
+        final String filename = primaryKey.toString().replace(':', '=');
+
+        final File sessionFile = new File(sessionDirectory, 
filename).getCanonicalFile();
+        if 
(!sessionDirectory.getCanonicalFile().equals(sessionFile.getParentFile())) {
+            throw new IOException("Invalid session id: " + filename + " does 
not resolve to a file directly inside the passivation directory");
+        }
+        return sessionFile;
+    }
 }
\ No newline at end of file
diff --git 
a/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java
 
b/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java
index 21a45a322e..6ef9b6403f 100644
--- 
a/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java
+++ 
b/container/openejb-core/src/main/java/org/apache/openejb/core/stateful/SimplePassivater.java
@@ -77,9 +77,7 @@ public class SimplePassivater implements PassivationStrategy {
 
     public void passivate(final Object primaryKey, final Object state) throws 
SystemException {
         try {
-            final String filename = primaryKey.toString().replace(':', '=');
-
-            final File sessionFile = new File(sessionDirectory, filename);
+            final File sessionFile = sessionFile(primaryKey);
 
             logger.info("Passivating to file " + sessionFile);
 
@@ -109,9 +107,7 @@ public class SimplePassivater implements 
PassivationStrategy {
     @Override
     public Object activate(final Object primaryKey) throws SystemException {
         try {
-            final String filename = primaryKey.toString().replace(':', '=');
-
-            final File sessionFile = new File(sessionDirectory, filename);
+            final File sessionFile = sessionFile(primaryKey);
 
             if (sessionFile.exists()) {
                 logger.info("Activating from file " + sessionFile);
@@ -134,4 +130,14 @@ public class SimplePassivater implements 
PassivationStrategy {
             throw new SystemException(t);
         }
     }
+
+    private File sessionFile(final Object primaryKey) throws IOException {
+        final String filename = primaryKey.toString().replace(':', '=');
+
+        final File sessionFile = new File(sessionDirectory, 
filename).getCanonicalFile();
+        if 
(!sessionDirectory.getCanonicalFile().equals(sessionFile.getParentFile())) {
+            throw new IOException("Invalid session id: " + filename + " does 
not resolve to a file directly inside the passivation directory");
+        }
+        return sessionFile;
+    }
 }
\ No newline at end of file