### Question:
FileURLAccessRule implements URLAccessRule { @Override public URL validate( Configuration config, URL url ) throws URLAccessValidationError { if ( !(url.getAuthority() == null || url.getAuthority().equals( "" )) ) { throw new URLAccessValidationError( "file URL may not contain an authority section (i.e. it should be 'file: } if ( !(url.getQuery() == null || url.getQuery().equals( "" )) ) { throw new URLAccessValidationError( "file URL may not contain a query component" ); } if ( !config.get( GraphDatabaseSettings.allow_file_urls ) ) { throw new URLAccessValidationError( "configuration property '" + GraphDatabaseSettings.allow_file_urls.name() + "' is false" ); } final File root = config.get( GraphDatabaseSettings.load_csv_file_url_root ); if ( root == null ) { return url; } try { final Path urlPath = Paths.get( url.toURI() ); final Path rootPath = root.toPath().normalize().toAbsolutePath(); final Path result = rootPath.resolve( urlPath.getRoot().relativize( urlPath ) ).normalize().toAbsolutePath(); if ( result.startsWith( rootPath ) ) { return result.toUri().toURL(); } throw new URLAccessValidationError( "file URL points outside configured import directory" ); } catch ( MalformedURLException | URISyntaxException e ) { throw new RuntimeException( e ); } }  @Override URL validate( Configuration config, URL url );  }### Answer:
@Test public void shouldThrowWhenFileURLContainsAuthority() throws Exception { try { URLAccessRules.fileAccess().validate( Config.defaults(), new URL( "file: fail( "expected exception not thrown " ); } catch ( URLAccessValidationError error ) { assertThat( error.getMessage(), equalTo( "file URL may not contain an authority section (i.e. it should be 'file: } }
@Test public void shouldThrowWhenFileURLContainsQuery() throws Exception { try { URLAccessRules.fileAccess().validate( Config.defaults(), new URL( "file: fail( "expected exception not thrown " ); } catch ( URLAccessValidationError error ) { assertThat( error.getMessage(), equalTo( "file URL may not contain a query component" ) ); } }
@Test public void shouldThrowWhenFileAccessIsDisabled() throws Exception { final URL url = new URL( "file: final Config config = Config.defaults( GraphDatabaseSettings.allow_file_urls, "false" ); try { URLAccessRules.fileAccess().validate( config, url ); fail( "expected exception not thrown " ); } catch ( URLAccessValidationError error ) { assertThat( error.getMessage(), equalTo( "configuration property 'dbms.security.allow_csv_import_from_file_urls' is false" ) ); } }
@Test public void shouldThrowWhenRelativePathIsOutsideImportDirectory() throws Exception { assumeFalse( Paths.get( "/" ).relativize( Paths.get( "/../baz.csv" ) ).toString().equals( "baz.csv" ) ); File importDir = new File( "/tmp/neo4jtest" ).getAbsoluteFile(); final Config config = Config.defaults( GraphDatabaseSettings.load_csv_file_url_root, importDir.toString() ); try { URLAccessRules.fileAccess().validate( config, new URL( "file: fail( "expected exception not thrown " ); } catch ( URLAccessValidationError error ) { assertThat( error.getMessage(), equalTo( "file URL points outside configured import directory" ) ); } }
@Test public void shouldAdjustURLToWithinImportDirectory() throws Exception { final URL url = new File( "/bar/baz.csv" ).toURI().toURL(); final Config config = Config.defaults( GraphDatabaseSettings.load_csv_file_url_root, "/var/lib/neo4j/import" ); URL accessURL = URLAccessRules.fileAccess().validate( config, url ); URL expected = new File( "/var/lib/neo4j/import/bar/baz.csv" ).toURI().toURL(); assertEquals( expected, accessURL ); }