Secure repository file paths and stream downloads

basyx.aasenvironment/basyx.aasenvironment-core/src/main/java/org/eclipse/digitaltwin/basyx/aasenvironment/base/DefaultAASEnvironment.java

@@ -371,7 +371,9 @@ private void handleFileError(File file) {
 
 
 	private byte[] getFileContent(String submodelId, File file) throws IOException {
-		return submodelRepository.getFileByFilePath(submodelId, file.getValue()).readAllBytes();
+		try (InputStream fileContent = submodelRepository.getFileByFilePath(submodelId, file.getValue())) {
+			return fileContent.readAllBytes();
+		}
 	}
 
 	private boolean isFileAlreadyAdded(String filePath){
@@ -386,7 +388,7 @@ private void addThumbnailToRelatedFiles(String aasId, Resource thumbnail, List<I
 				String newPath = getThumbnailPathInAASX(thumbnail.getPath());
 				relatedFiles.add(
 						new InMemoryFile(
-								Files.readAllBytes(aasRepository.getThumbnail(aasId).toPath()),
+								getThumbnailContent(aasId),
 								newPath
 						)
 				);
@@ -397,6 +399,25 @@ private void addThumbnailToRelatedFiles(String aasId, Resource thumbnail, List<I
 		}
 	}
 
+	private byte[] getThumbnailContent(String aasId) throws IOException {
+		try (InputStream thumbnailContent = aasRepository.getThumbnailInputStream(aasId)) {
+			return thumbnailContent.readAllBytes();
+		} catch (UnsupportedOperationException e) {
+			return getThumbnailContentFromFile(aasId);
+		}
+	}
+
+	private byte[] getThumbnailContentFromFile(String aasId) throws IOException {
+		java.io.File thumbnailFile = aasRepository.getThumbnail(aasId);
+
+		try {
+			return Files.readAllBytes(thumbnailFile.toPath());
+		} finally {
+			if (thumbnailFile != null)
+				thumbnailFile.delete();
+		}
+	}
+
 	private static boolean isThumbnailSet(Resource thumbnail) {
 		return thumbnail != null && thumbnail.getPath() != null;
 	}

basyx.aasrepository/basyx.aasrepository-backend/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/backend/CrudAasRepository.java

@@ -138,6 +138,11 @@ public File getThumbnail(String aasId) {
 		return getService(aasId).getThumbnail();
 	}
 
+	@Override
+	public InputStream getThumbnailInputStream(String aasId) {
+		return getService(aasId).getThumbnailInputStream();
+	}
+
 	@Override
 	public void setThumbnail(String aasId, String fileName, String contentType, InputStream inputStream) {
 		getService(aasId).setThumbnail(fileName, contentType, inputStream);

basyx.aasrepository/basyx.aasrepository-client/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/client/ConnectedAasRepository.java

@@ -181,6 +181,11 @@ public File getThumbnail(String aasId) {
 		return getConnectedAasService(aasId).getThumbnail();
 	}
 
+	@Override
+	public InputStream getThumbnailInputStream(String aasId) {
+		return getConnectedAasService(aasId).getThumbnailInputStream();
+	}
+
 	@Override
 	public void setThumbnail(String aasId, String fileName, String contentType, InputStream inputStream) {
 		getConnectedAasService(aasId).setThumbnail(fileName, contentType, inputStream);

basyx.aasrepository/basyx.aasrepository-core/src/main/java/org/eclipse/digitaltwin/basyx/aasrepository/AasRepository.java

@@ -1,30 +1,32 @@
 /*******************************************************************************
  * Copyright (C) 2023 the Eclipse BaSyx Authors
- * 
+ *
  * Permission is hereby granted, free of charge, to any person obtaining
  * a copy of this software and associated documentation files (the
  * "Software"), to deal in the Software without restriction, including
  * without limitation the rights to use, copy, modify, merge, publish,
  * distribute, sublicense, and/or sell copies of the Software, and to
  * permit persons to whom the Software is furnished to do so, subject to
  * the following conditions:
- * 
+ *
  * The above copyright notice and this permission notice shall be
  * included in all copies or substantial portions of the Software.
- * 
+ *
  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
  * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
  * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
  * LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
  * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- * 
+ *
  * SPDX-License-Identifier: MIT
  ******************************************************************************/
 package org.eclipse.digitaltwin.basyx.aasrepository;
 
 import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
 import java.io.InputStream;
 import java.util.List;
 
@@ -34,28 +36,29 @@
 import org.eclipse.digitaltwin.aas4j.v3.model.SpecificAssetId;
 import org.eclipse.digitaltwin.basyx.core.exceptions.CollidingIdentifierException;
 import org.eclipse.digitaltwin.basyx.core.exceptions.ElementDoesNotExistException;
+import org.eclipse.digitaltwin.basyx.core.exceptions.FileHandlingException;
 import org.eclipse.digitaltwin.basyx.core.exceptions.MissingIdentifierException;
 import org.eclipse.digitaltwin.basyx.core.pagination.CursorResult;
 import org.eclipse.digitaltwin.basyx.core.pagination.PaginationInfo;
 
 /**
  * Specifies the overall AasRepository API
- * 
+ *
  * @author schnicke, kammognie
  *
  */
 public interface AasRepository {
-	
+
 	/**
 	 * Retrieves all Asset Administration Shells from the repository
-	 * 
+	 *
 	 * @return a list of all found Asset Administration Shells
 	 */
 	public CursorResult<List<AssetAdministrationShell>> getAllAas(List<SpecificAssetId> assetIds, String idShort, PaginationInfo pInfo);
 
 	/**
 	 * Retrieves a specific AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
 	 * @return the requested AAS
@@ -64,7 +67,7 @@ public interface AasRepository {
 
 	/**
 	 * Creates a new AAS at the endpoint
-	 * 
+	 *
 	 * @param aas
 	 *            the AAS to be created
 	 * @throws MissingIdentifierException
@@ -74,22 +77,22 @@ public interface AasRepository {
 
 	/**
 	 * Deletes a specific AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS to be deleted
 	 */
 	public void deleteAas(String aasId);
 
 	/**
 	 * Overwrites an existing AAS
-	 * 
+	 *
 	 * @param aas
 	 */
 	public void updateAas(String aasId, AssetAdministrationShell aas);
 
 	/**
 	 * Returns a List of References to Submodels
-	 * 
+	 *
 	 * @param aasId
 	 * @param pInfo
 	 * @return
@@ -98,48 +101,67 @@ public interface AasRepository {
 
 	/**
 	 * Adds a Submodel Reference
-	 * 
+	 *
 	 * @param submodelReference
 	 */
 	public void addSubmodelReference(String aasId, Reference submodelReference);
 
 	/**
 	 * Removes a Submodel Reference
-	 * 
+	 *
 	 * @param submodelId
 	 */
 	public void removeSubmodelReference(String aasId, String submodelId);
 
 	/**
 	 * Sets the asset-information of a specific AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
 	 */
 	public void setAssetInformation(String aasId, AssetInformation aasInfo) throws ElementDoesNotExistException;
 
 	/**
 	 * Retrieves the asset-information of a specific AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
-	 * 
+	 *
 	 * @return the requested AAS
 	 */
 	public AssetInformation getAssetInformation(String aasId) throws ElementDoesNotExistException;
 
 	/**
 	 * Get Thumbnail of the specific aas
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
 	 * @return the file of the thumbnail
 	 */
 	public File getThumbnail(String aasId);
 
+	/**
+	 * Get Thumbnail content of the specific aas as a stream
+	 * <p>
+	 * The caller is responsible for closing the returned stream.
+	 *
+	 * @param aasId
+	 *            the id of the AAS
+	 * @return the stream of the thumbnail
+	 * @throws org.eclipse.digitaltwin.basyx.core.exceptions.FileDoesNotExistException
+	 *             if no thumbnail is stored
+	 */
+	public default InputStream getThumbnailInputStream(String aasId) {
+		try {
+			return new FileInputStream(getThumbnail(aasId));
+		} catch (FileNotFoundException e) {
+			throw new FileHandlingException("Could not open thumbnail stream.", e);
+		}
+	}
+
 	/**
 	 * Set Thumbnail of the AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
 	 * @param fileName
@@ -153,19 +175,19 @@ public interface AasRepository {
 
 	/**
 	 * Delete the thumbnail file of the AAS
-	 * 
+	 *
 	 * @param aasId
 	 *            the id of the AAS
 	 */
 	public void deleteThumbnail(String aasId);
-    
+
 	/**
 	 * Returns the name of the repository
-	 * 
+	 *
 	 * @return repoName
 	 */
 	public default String getName() {
 		return "aas-repo";
 	}
-	
+
 }

basyx.aasrepository/basyx.aasrepository-core/src/test/java/org/eclipse/digitaltwin/basyx/aasrepository/AasRepositoryAasServiceWrapper.java

@@ -88,6 +88,11 @@ public File getThumbnail() {
 		return repoApi.getThumbnail(aasId);
 	}
 
+	@Override
+	public InputStream getThumbnailInputStream() {
+		return repoApi.getThumbnailInputStream(aasId);
+	}
+
 	@Override
 	public void setThumbnail(String fileName, String contentType, InputStream inputStream) {
 		repoApi.setThumbnail(aasId, fileName, contentType, inputStream);