Add separate email templates dir

Dockerfile

@@ -27,10 +27,11 @@ COPY --from=webappbuild /www/ /usr/local/tomee/webapps/ROOT/
 
 # Copy the war file to the webapps directory
 COPY --from=javabuild /app/build/libs/irma_email_issuer.war /usr/local/tomee/webapps/
-COPY ./src/main/resources/email-en.html /config/email-en.html
-COPY ./src/main/resources/email-nl.html /config/email-nl.html
+COPY ./src/main/resources/email-en.html /email-templates/email-en.html
+COPY ./src/main/resources/email-nl.html /email-templates/email-nl.html
 
 ENV IRMA_CONF="/config/"
+ENV EMAIL_TEMPLATE_DIR="/email-templates/"
 EXPOSE 8080
 
 # Copy the config file to the webapp. This is done at runtime so that the config file can be mounted as a volume.

src/main/java/foundation/privacybydesign/email/EmailConfiguration.java

@@ -66,7 +66,7 @@ public static void load() {
 
     public String getVerifyEmailBody(String language) {
         try {
-            return new String(EmailConfiguration.getResource("email-" + language + ".html"));
+            return new String(EmailConfiguration.getEmailTemplate("email-" + language + ".html"));
         } catch (IOException e) {
             logger.error("Failed to read email file");
             throw new RuntimeException(e);

src/main/java/foundation/privacybydesign/email/common/BaseConfiguration.java

@@ -20,6 +20,8 @@
 import java.security.spec.X509EncodedKeySpec;
 import java.util.ArrayList;
 import java.util.HashMap;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 
 public class BaseConfiguration<T> {
     // Override these in a static {} block
@@ -28,13 +30,17 @@ public class BaseConfiguration<T> {
     public static String filename = "config.json";
     public static String environmentVarPrefix = "IRMA_CONF_";
     public static String confDirEnvironmentVarName = "IRMA_CONF";
+    public static String emailTemplateDirVarName = "EMAIL_TEMPLATE_DIR";
+    public static String emailTemplateDir;
     public static String confDirName;
+    public static String templatefDirName;
     public static boolean printOnLoad = false;
     public static boolean testing = false;
 
     // Return this from a static getInstance()
     public static BaseConfiguration<?> instance;
     private static URI confPath;
+    private static URI templatePath;
 
 
     public static void load() {
@@ -68,6 +74,31 @@ public static byte[] getResource(String filename) throws IOException {
         return convertStreamToByteArray(getResourceStream(filename), 2048);
     }
 
+    public static FileInputStream getEmailTemplateStream(String filename) throws IOException {
+        validateFilename(filename);
+        Path resolvedPath = resolvePath(getTemplateDirectory(), filename);
+        return new FileInputStream(resolvedPath.toFile());
+    }
+
+    private static void validateFilename(String filename) {
+        if (filename == null || filename.isEmpty() || filename.contains("..")) {
+            throw new IllegalArgumentException("Invalid filename: " + filename);
+        }
+        // Optional: Add further filename validation, such as allowed extensions
+    }
+
+    private static Path resolvePath(URI baseDirectory, String filename) {
+        Path resolvedPath = new File(baseDirectory).toPath().resolve(filename).normalize();
+        if (!resolvedPath.startsWith(new File(baseDirectory).toPath())) {
+            throw new SecurityException("Path traversal attempt detected for file: " + filename);
+        }
+        return resolvedPath;
+    }
+
+    public static byte[] getEmailTemplate(String filename) throws IOException {
+        return convertStreamToByteArray(getEmailTemplateStream(filename), 2048);
+    }
+
     public static byte[] convertStreamToByteArray(InputStream stream, int size) throws IOException {
         byte[] buffer = new byte[size];
         ByteArrayOutputStream os = new ByteArrayOutputStream();
@@ -211,6 +242,71 @@ public static URI getEnvironmentVariableConfDir() throws URISyntaxException {
         return pathToURI(envDir, true);
     }
 
+    public static URI getEnvironmentVariableTemplateDir() throws URISyntaxException {
+        String envDir = System.getenv(emailTemplateDirVarName);
+        if (envDir == null || envDir.length() == 0)
+            return null;
+        return pathToURI(envDir, true);
+    }
+
+
+    public static URI getTemplateDirectory() throws IllegalStateException, IllegalArgumentException {
+        if (templatePath != null)
+            return templatePath;
+
+        try {
+            // If we're running unit tests, only accept src/test/resources
+            URI resourcesCandidate = GetJavaResourcesDirectory();
+            if (BaseConfiguration.testing) {
+                if (resourcesCandidate != null) {
+                    logger.info("Running tests: taking src/test/resources as configuration directory");
+                    templatePath = resourcesCandidate;
+                    return templatePath;
+                }
+                else {
+                    throw new IllegalStateException("No configuration found in in src/test/resources. " +
+                            "(Have you run `git submodule init && git submodule update`?)");
+                }
+            }
+
+            // If a path was given in the $confDirEnvironmentVarName environment variable, prefer it
+            URI envCandidate = getEnvironmentVariableTemplateDir();
+            if (envCandidate != null) {
+                if (isConfDirectory(envCandidate)) {
+                    logger.info("Taking template directory specified by environment variable " + emailTemplateDirVarName);
+                    templatePath = envCandidate;
+                    return templatePath;
+                } else {
+                    // If the user specified an incorrect path (s)he will want to know, so bail out here
+                    throw new IllegalArgumentException("Specified path in " + emailTemplateDirVarName
+                            + " is not a valid configuration directory");
+                }
+            }
+
+            // See if a number of other fixed candidates are suitable
+            ArrayList<URI> candidates = new ArrayList<>(4);
+            candidates.add(resourcesCandidate);
+            if (templatefDirName != null) {
+                candidates.add(pathToURI("/etc/" + templatefDirName, true));
+                candidates.add(pathToURI("C:/" + templatefDirName, true));
+                candidates.add(pathToURI(System.getProperty("user.home")+"/"+templatefDirName, true));
+            }
+
+            for (URI candidate : candidates) {
+                if (isConfDirectory(candidate)) {
+                    templatePath = candidate;
+                    return templatePath;
+                }
+            }
+
+            throw new IllegalStateException("No valid template directory found");
+        } catch (URISyntaxException e) {
+            throw new IllegalArgumentException(e);
+        }
+    }
+
+
+
     /**
      * Returns true if the specified path is a valid configuration directory. A directory
      * is considered a valid configuration directory if it contains a file called $filename.