Error on Mac: BCV is awesome, blocking write

[harmeet24]

I am trying to use ByteCodeViewer on Mac 11.6, after executing the java -jar Bytecode-Viewer-2.10.16jar, the program runs successfully. When I am trying to add a class file and click on the File -> Add getting the following exception in the console and unable to add any class file in the viewer.

Exception in thread "AWT-EventQueue-0" java.lang.SecurityException: BCV is awesome, blocking write(/Users/singh);
	at the.bytecode.club.bytecodeviewer.util.SecurityMan.checkWrite(SecurityMan.java:339)
	at java.base/java.io.File.canWrite(File.java:794)
	at java.desktop/sun.awt.shell.ShellFolder.canWrite(ShellFolder.java:369)
	at java.desktop/com.apple.laf.AquaFileChooserUI$2.propertyChange(AquaFileChooserUI.java:471)
	at java.desktop/java.beans.PropertyChangeSupport.fire(PropertyChangeSupport.java:341)
	at java.desktop/java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:333)
	at java.desktop/java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:266)
	at java.desktop/java.awt.Component.firePropertyChange(Component.java:8731)
	at java.desktop/javax.swing.JFileChooser.setCurrentDirectory(JFileChooser.java:608)
	at java.desktop/javax.swing.JFileChooser.<init>(JFileChooser.java:362)
	at java.desktop/javax.swing.JFileChooser.<init>(JFileChooser.java:308)
	at the.bytecode.club.bytecodeviewer.gui.components.FileChooser.<init>(FileChooser.java:26)
	at the.bytecode.club.bytecodeviewer.util.DialogUtils.fileChooser(DialogUtils.java:95)
	at the.bytecode.club.bytecodeviewer.util.DialogUtils.fileChooser(DialogUtils.java:84)
	at the.bytecode.club.bytecodeviewer.util.DialogUtils.fileChooser(DialogUtils.java:76)
	at the.bytecode.club.bytecodeviewer.gui.MainViewerGUI.selectFile(MainViewerGUI.java:892)
	at the.bytecode.club.bytecodeviewer.gui.MainViewerGUI.lambda$buildFileMenu$0(MainViewerGUI.java:360)
	at java.desktop/javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1967)
	at java.desktop/javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2308)
	at java.desktop/javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405)
	at java.desktop/javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262)
	at java.desktop/javax.swing.AbstractButton.doClick(AbstractButton.java:369)
	at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI.doClick(BasicMenuItemUI.java:1020)
	at java.desktop/com.apple.laf.AquaMenuItemUI.doClick(AquaMenuItemUI.java:157)
	at java.desktop/javax.swing.plaf.basic.BasicMenuItemUI$Handler.mouseReleased(BasicMenuItemUI.java:1064)
	at java.desktop/java.awt.Component.processMouseEvent(Component.java:6635)
	at java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3342)
	at java.desktop/java.awt.Component.processEvent(Component.java:6400)
	at java.desktop/java.awt.Container.processEvent(Container.java:2263)
	at java.desktop/java.awt.Component.dispatchEventImpl(Component.java:5011)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2321)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4843)
	at java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4918)
	at java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4547)
	at java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4488)
	at java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2307)
	at java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2772)
	at java.desktop/java.awt.Component.dispatchEvent(Component.java:4843)
	at java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:772)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:721)
	at java.desktop/java.awt.EventQueue$4.run(EventQueue.java:715)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:95)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:745)
	at java.desktop/java.awt.EventQueue$5.run(EventQueue.java:743)
	at java.base/java.security.AccessController.doPrivileged(Native Method)
	at java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:85)
	at java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:742)
	at java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)
	at java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)
	at java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)
	at java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

[CoooWeee]

same here osx 12.0.1 and bytecode view 2.10.16

I added java to "Full Disk Access" but did not help.

[umjammer]

i got the reason.

in the class the.bytecode.club.bytecodeviewer.util.SecurityMan, path (file) names are compared by strings.
one is a plain string path, another is getCanonicalPath()-ed path.

in my environment, my home folder is located on another drive and is symbolic-linked to /Users/me.
so plain path string and getCanonicalPath()-ed path would be different.

bytecode-viewer/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java

Lines 312 to 339 in e4543ea

	public void checkWrite(String file) {
	if(printing)
	System.out.println("Writing: " + file);
	try
	{
	//can only export as the following extensions
	if(file.endsWith(".zip") || file.endsWith(".jar") || file.endsWith(".apk")
	|| file.endsWith(".dex") || file.endsWith(".class") || file.endsWith("js")
	|| file.endsWith(".java") || file.endsWith(".gy") || file.endsWith(".bcv")
	|| file.endsWith(".json") || file.endsWith(".txt") || file.endsWith(".log"))
	return;
	//can only write into BCV dir
	if(file.startsWith(Constants.BCVDir.getCanonicalPath()))
	return;
	//can only write into system temp
	if(file.startsWith(Constants.systemTempDirectory))
	return;
	}
	catch (IOException e)
	{
	throw new SecurityException(e);
	}
	throw new SecurityException("BCV is awesome, blocking write(" + file + ");");
	}

one solution is to make file getCanonicalPath()-ed. like,

diff --git a/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java b/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java
index 88f0e3d..9d7ddcb 100644
--- a/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java
+++ b/src/main/java/the/bytecode/club/bytecodeviewer/util/SecurityMan.java
@@ -319,6 +319,8 @@ public class SecurityMan extends SecurityManager
         
         try
         {
+            file = new File(file).getCanonicalPath();
+
             //can only export as the following extensions
             if(file.endsWith(".zip") || file.endsWith(".jar") || file.endsWith(".apk")
                     || file.endsWith(".dex") || file.endsWith(".class") || file.endsWith("js")

but i think is this necessary in the first place? at least on Mac, Mac has own quarantine system by OS.
and i don't recommend to use getCanonicalPath(), because getCanonicalPath() costs high and this routine is called every time Java write.

[dhowe]

Similar error here after attempting to decompile class files on OS X 11.6.1:

Exception in thread "Decompile Thread" java.lang.SecurityException: BCV is awesome, blocking write(/Users/user);
at the.bytecode.club.bytecodeviewer.util.SecurityMan.checkWrite(SecurityMan.java:338)

$ java -jar Bytecode-Viewer-2.10.16.jar
Bytecode Viewer 2.10.16 [Fat Jar] - Created by @Konloch
https://bytecodeviewer.com - https://the.bytecode.club
Extracting Krakatau
Start up took 7 seconds
Successfully extracted Krakatau
Extracting Enjarify
Opening.../Users/dhowe/Desktop/App_base.apk
I: Using Apktool 2.5.0-c83c73-SNAPSHOT on LNHVGMyULjxTSkmLfhezVdyvlldLDT.apk
I: Loading resource table...
I: Decoding AndroidManifest.xml with resources...
I: Loading resource table from file: /Users/dhowe/.Bytecode-Viewer/bcv_temp/JjpplBFRxELS/1.apk
I: Regular manifest package...
I: Decoding file-resources...
I: Decoding values / XMLs...
I: Baksmaling classes.dex...
I: Copying assets and libs...
I: Copying unknown files...
I: Copying original files...
Successfully extracted Enjarify
Exception in thread "Decompile Thread" java.lang.SecurityException: BCV is awesome, blocking write(/Users/dhowe);
at the.bytecode.club.bytecodeviewer.util.SecurityMan.checkWrite(SecurityMan.java:338)
at java.io.File.canWrite(File.java:791)
at sun.awt.shell.ShellFolder.canWrite(ShellFolder.java:368)
at com.apple.laf.AquaFileChooserUI$2.propertyChange(AquaFileChooserUI.java:403)
at java.beans.PropertyChangeSupport.fire(PropertyChangeSupport.java:335)
at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:327)
at java.beans.PropertyChangeSupport.firePropertyChange(PropertyChangeSupport.java:263)
at java.awt.Component.firePropertyChange(Component.java:8434)
at javax.swing.JFileChooser.setCurrentDirectory(JFileChooser.java:598)
at javax.swing.JFileChooser.(JFileChooser.java:344)
at javax.swing.JFileChooser.(JFileChooser.java:296)
at the.bytecode.club.bytecodeviewer.gui.components.FileChooser.(FileChooser.java:43)
at the.bytecode.club.bytecodeviewer.gui.components.FileChooser.(FileChooser.java:39)
at the.bytecode.club.bytecodeviewer.resources.ResourceDecompiling.lambda$decompileSaveAll$8(ResourceDecompiling.java:56)
at java.lang.Thread.run(Thread.java:748)