org.apache.tika.server.URLEnabledInputStreamFactory Maven / Gradle / Ivy

/*
 * Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.apache.tika.server;

import javax.ws.rs.core.HttpHeaders;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;

import org.apache.tika.io.TikaInputStream;

/**
 * This class looks for "fileUrl" in the http header.  If it is not null
 * and not empty, this will return a new TikaInputStream from the URL.
 * 
 * This is not meant to be used in place of a robust, responsible crawler.  Rather, this
 * is a convenience factory.
 * 
 * WARNING: Unless you carefully lock down access to the server,
 * whoever has access to this service will have the read access of the server.
 * In short, anyone with access to this service could request and get
 * "file:///etc/supersensitive_file_dont_read.txt".  Or, if your server has access
 * to your intranet, and you let the public hit this service, they will now
 * have access to your intranet.
 * See CVE-2015-3271
 *
 */
public class URLEnabledInputStreamFactory implements InputStreamFactory {

    @Override
    public InputStream getInputSteam(InputStream is, HttpHeaders httpHeaders) throws IOException {
        String fileUrl = httpHeaders.getHeaderString("fileUrl");
        if(fileUrl != null && !"".equals(fileUrl)){
            return TikaInputStream.get(new URL(fileUrl));
        }
        return is;
    }
}