Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
com.github.robtimus:ftp-fs
Advanced tools
The ftp-fs
library provides support for FTP and FTPS NIO.2 file systems, allowing FTP servers to be accessed in a similar way to local file systems.
If the FTP file system library is available on the class path, it will register FileSystemProviders for schemes ftp
and ftps
. This allows you to create FTP and FTPS file systems using the newFileSystem
methods of class FileSystems. You can use classes FTPEnvironment and FTPSEnvironment to help create the environment maps for those methods:
FTPEnvironment env = new FTPEnvironment()
.withCredentials(username, password);
FileSystem fs = FileSystems.newFileSystem(URI.create("ftp://example.org"), env);
Credentials can be provided either through the URI or through the environment, as shown above. For security reasons the latter is preferred.
The default directory can be provided through the URI or trough the environment using withDefaultDirectory, as follows:
URI path | No default directory in the environment | Default directory in the environment |
---|---|---|
None | The default directory is defined by the FTP server | The default directory is defined by the environment |
/ | The default directory is / | The default directory is defined by the environment |
Other | The default directory is equal to the URI path | Not allowed |
After a file system has been created, Paths can be created through the file system itself using its getPath method. As long as the file system is not closed, it's also possible to use Paths.get. Note that if the file system was created with credentials, the username must be part of the URL. For instance:
// created without credentials
Path path1 = Paths.get(URI.create("ftp://example.org"));
// created with credentials
Path path2 = Paths.get(URI.create("ftp://username@example.org"));
If the username in the URI does not match the username used to create the file system, or if no file system has been created for the URI, a new file system will be created. This works like Creating file systems. Since no environment can be provided this way, settings can still be provided through FTPEnvironment.setDefault or FTPSEnvironment.setDefault and query parameters; see usages of QueryParam and QueryParams for the possible query parameters. If creating a new file system fails, a FileSystemNotFoundException will be thrown.
FTP file systems fully support read-access to the following attributes:
basic:
or posix:
.owner:
or posix:
.posix:
.Attempting to set any of these attributes, either through one of the file attribute views or through a file system, will result in an UnsupportedOperationException.
When calling getAttribute on a file store, the following attributes are supported:
totalSpace
: returns the same value as the getTotalSpace method.usableSpace
: returns the same value as the getUsableSpace method.unallocatedSpace
: returns the same value as the getUnallocatedSpace method.Because FTP servers do not return these values, these methods will all return Long.MAX_VALUE
.
There is no support for FileStoreAttributeView. Calling getFileStoreAttributeView on a file store will simply return null
.
To create an FTPS connection instead of an FTP connection, use ftps
as the scheme. Also, use class FTPSEnvironment instead of class FTPEnvironment to create the file system. Using an FTPEnvironment instance is still allowed, but you will not be able to specify FTPS specific properties.
Unfortunately, FTP servers can use the same code for multiple erroneous situations. For example, code 550 can indicate that a file does not exist, or that access to an existing file is not allowed. Because of this, most methods do not throw the correct exception (NoSuchFileException, AccessDeniedException, etc).
To allow this behaviour to be modified, class FTPEnvironment has method withFileSystemExceptionFactory that allows you to specify a custom FileSystemExceptionFactory implementation which will be used to create exceptions based on the reply code and string of the command that triggered the error. By default, an instance of class DefaultFileSystemExceptionFactory is used.
The ftp-fs
library provides subclasses for FileSystemException and several of its subclasses to allow the FTP server's reply code and string to be reserved. Instances of these classes can be returned by FileSystemExceptionFactory implementations as needed.
The FTP protocol is fundamentally not thread safe. To overcome this limitation, FTP file systems maintain multiple connections to FTP servers. The number of connections determines the number of concurrent operations that can be executed. If all connections are busy, a new operation will block until a connection becomes available. Class FTPEnvironment has method withPoolConfig that allows you to configure the connection pool:
1
.5
.When a stream or channel is opened for reading or writing, the connection will block because it will wait for the download or upload to finish. This will not occur until the stream or channel is closed. It is therefore advised to close streams and channels as soon as possible.
Because FTP file systems use multiple connections to an FTP server, it's possible that one or more of these connections become stale. Class FTPFileSystemProvider has static method keepAlive that, if given an instance of an FTP file system, will send a keep-alive signal (NOOP) over each of its idle connections. You should ensure that this method is called on a regular interval. An alternative is to set a maximum idle time (see Thread safety).
FTP file systems knows the following limitations:
/
as separator. /
is not allowed inside file or directory names.FAQs
An FTP(S) NIO.2 file system
We found that com.github.robtimus:ftp-fs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.