redirect file ctor

Author: brachy84

src/main/java/com/cleanroommc/groovyscript/helper/Wrapper.java

@@ -0,0 +1,44 @@
+package com.cleanroommc.groovyscript.helper;
+
+import com.cleanroommc.groovyscript.GroovyScript;
+import com.cleanroommc.groovyscript.api.GroovyLog;
+import com.cleanroommc.groovyscript.sandbox.FileUtil;
+
+import java.io.File;
+import java.net.URI;
+
+public class Wrapper {
+
+    public static void validatePath(String path) {
+        if (!path.startsWith(GroovyScript.getMinecraftHome().getPath())) {
+            throw new SecurityException("Only files in minecraft home and sub directories can be accessed from scripts! Tried to access " + path);
+        }
+    }
+
+    public static void logFileCtorWarning() {
+        GroovyLog.get().warn("Tried to use `new File(...)` constructor. Use `file(...)` instead!");
+    }
+
+    public static File wrappedFileCtor(String path) {
+        logFileCtorWarning();
+        return GroovyHelper.file(path);
+    }
+
+    public static File wrappedFileCtor(String parent, String child) {
+        logFileCtorWarning();
+        return GroovyHelper.file(parent, child);
+    }
+
+    public static File wrappedFileCtor(File parent, String child) {
+        logFileCtorWarning();
+        File file = new File(parent, FileUtil.sanitizePath(child));
+        validatePath(file.getPath());
+        return file;
+    }
+
+    public static File wrappedFileCtor(URI uri) {
+        File file = new File(uri);
+        validatePath(file.getPath());
+        return file;
+    }
+}

src/main/java/com/cleanroommc/groovyscript/sandbox/FileUtil.java

@@ -1,6 +1,5 @@
 package com.cleanroommc.groovyscript.sandbox;
 
-import com.google.common.base.Joiner;
 import net.minecraftforge.fml.common.Loader;
 import org.apache.commons.lang3.StringUtils;
 
@@ -10,8 +9,6 @@
 
 public class FileUtil {
 
-    private static final Joiner fileJoiner = Joiner.on(File.separator);
-
     public static String relativize(String rootPath, String longerThanRootPath) {
         if (File.separatorChar != '/') {
             longerThanRootPath = longerThanRootPath.replace('/', File.separatorChar);
@@ -30,7 +27,26 @@ public static String getParent(String path) {
     }
 
     public static String makePath(String... pieces) {
-        return fileJoiner.join(pieces);
+        if (pieces == null || pieces.length == 0) return StringUtils.EMPTY;
+        if (pieces.length == 1) return sanitizePath(pieces[0]);
+        StringBuilder builder = new StringBuilder();
+        for (String piece : pieces) {
+            if (piece != null && !piece.isEmpty()) {
+                builder.append(sanitizePath(piece)).append(File.separatorChar);
+            }
+        }
+        if (builder.length() > 0) {
+            builder.deleteCharAt(builder.length() - 1);
+        }
+        return builder.toString();
+    }
+
+    public static String sanitizePath(String path) {
+        return path.replace(getOtherSeparatorChar(), File.separatorChar);
+    }
+
+    public static char getOtherSeparatorChar() {
+        return File.separatorChar == '/' ? '\\' : '/';
     }
 
     public static File makeFile(String... pieces) {

src/main/java/com/cleanroommc/groovyscript/sandbox/transformer/GroovyScriptTransformer.java

@@ -1,7 +1,7 @@
 package com.cleanroommc.groovyscript.sandbox.transformer;
 
-import com.cleanroommc.groovyscript.api.GroovyLog;
 import com.cleanroommc.groovyscript.gameobjects.GameObjectHandlerManager;
+import com.cleanroommc.groovyscript.helper.Wrapper;
 import org.codehaus.groovy.ast.ClassCodeExpressionTransformer;
 import org.codehaus.groovy.ast.ClassHelper;
 import org.codehaus.groovy.ast.ClassNode;
@@ -16,6 +16,7 @@
 public class GroovyScriptTransformer extends ClassCodeExpressionTransformer {
 
     private static final ClassNode bracketHandlerClass = ClassHelper.makeCached(GameObjectHandlerManager.class);
+    private static final ClassNode wrapper = ClassHelper.makeCached(Wrapper.class);
     private final SourceUnit source;
     private final ClassNode classNode;
 
@@ -29,10 +30,25 @@ protected SourceUnit getSourceUnit() {
         return source;
     }
 
-    private static Expression makeCheckedCall(ClassNode classNode, String name, Expression... arguments) {
+    private static Expression makeCheckedCall(ClassNode classNode, String name, List<Expression> arguments) {
         return new StaticMethodCallExpression(classNode, name, new ArgumentListExpression(arguments));
     }
 
+    private static Expression makeCheckedCall(ClassNode classNode, String name, Expression arguments) {
+        return makeCheckedCall(classNode, name, getArguments(arguments));
+    }
+
+    private static List<Expression> getArguments(Expression expr) {
+        List<Expression> args;
+        if (expr instanceof TupleExpression te) {
+            args = new ArrayList<>(te.getExpressions());
+        } else {
+            args = new ArrayList<>();
+            args.add(expr);
+        }
+        return args;
+    }
+
     @Override
     public Expression transform(Expression expr) {
         if (expr == null) return null;
@@ -52,7 +68,7 @@ private Expression transformInternal(Expression expr) {
             return checkValid((MethodCallExpression) expr);
         }
         if (expr instanceof ConstructorCallExpression cce && cce.getType().getName().equals(File.class.getName())) {
-            GroovyLog.get().warn("Detected `new File(...)` usage. Use `file(...)` instead!");
+            return makeCheckedCall(wrapper, "wrappedFileCtor", cce.getArguments());
         }
         return expr;
     }
@@ -81,14 +97,9 @@ private Expression checkValid(MethodCallExpression expression) {
         if (expression.isImplicitThis() && argCount > 0) {
             String name = expression.getMethodAsString();
             if (GameObjectHandlerManager.hasGameObjectHandler(name)) {
-                List<Expression> args;
-                if (expression.getArguments() instanceof TupleExpression) {
-                    args = ((TupleExpression) expression.getArguments()).getExpressions();
-                } else {
-                    args = new ArrayList<>();
-                }
+                List<Expression> args = getArguments(expression.getArguments());
                 args.add(0, new ConstantExpression(name));
-                return makeCheckedCall(bracketHandlerClass, "getGameObject", args.toArray(new Expression[0]));
+                return makeCheckedCall(bracketHandlerClass, "getGameObject", args);
             }
         }
         return expression;