#2305 Ensure file is closed

TheHive-Project · Jan 24, 2022 · 226a60b · 226a60b
1 parent 5e42814
commit 226a60b
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 7 deletions.
diff --git a/ScalliGraph b/ScalliGraph
diff --git a/thehive/app/org/thp/thehive/controllers/v0/AttachmentCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/AttachmentCtrl.scala
@@ -17,14 +17,16 @@ import play.api.mvc._
 
 import java.nio.file.Files
 import javax.inject.{Inject, Singleton}
+import scala.concurrent.ExecutionContext
 import scala.util.{Failure, Try}
 
 @Singleton
 class AttachmentCtrl @Inject() (
     entrypoint: Entrypoint,
     appConfig: ApplicationConfig,
     attachmentSrv: AttachmentSrv,
-    db: Database
+    db: Database,
+    ec: ExecutionContext
 ) {
   val forbiddenChar: Seq[Char] = Seq('/', '\n', '\r', '\t', '\u0000', '\f', '`', '?', '*', '\\', '<', '>', '|', '\"', ':', ';')
 
@@ -76,8 +78,12 @@ class AttachmentCtrl @Inject() (
               zipParams.setEncryptionMethod(EncryptionMethod.ZIP_STANDARD)
               zipParams.setFileNameInZip(filename)
               //      zipParams.setSourceExternalStream(true)
-              zipFile.addStream(attachmentSrv.stream(attachment), zipParams)
-
+              val is = attachmentSrv.stream(attachment)
+              try zipFile.addStream(is, zipParams)
+              finally is.close()
+              val source = FileIO.fromPath(f).mapMaterializedValue { fut =>
+                fut.andThen { case _ => Files.delete(f) }(ec)
+              }
               Result(
                 header = ResponseHeader(
                   200,
@@ -88,8 +94,8 @@ class AttachmentCtrl @Inject() (
                     "Content-Length"            -> Files.size(f).toString
                   )
                 ),
-                body = HttpEntity.Streamed(FileIO.fromPath(f), Some(Files.size(f)), Some("application/zip"))
-              ) // FIXME remove temporary file (but when ?)
+                body = HttpEntity.Streamed(source, Some(Files.size(f)), Some("application/zip"))
+              )
             }
           }
           .recoverWith {

diff --git a/thehive/app/org/thp/thehive/services/AttachmentSrv.scala b/thehive/app/org/thp/thehive/services/AttachmentSrv.scala
@@ -65,7 +65,10 @@ class AttachmentSrv @Inject() (configuration: Configuration, storageSrv: Storage
       case Some(a) => (a.size, a.hashes)
       case None =>
         val s  = storageSrv.getSize("attachment", attachmentId).getOrElse(throw NotFoundError(s"Attachment $attachmentId not found"))
-        val hs = hashers.fromInputStream(storageSrv.loadBinary("attachment", attachmentId))
+        val is = storageSrv.loadBinary("attachment", attachmentId)
+        val hs =
+          try hashers.fromInputStream(is)
+          finally is.close()
         (s, hs)
     }
     createEntity(Attachment(filename, size, contentType, hashes, attachmentId))