[sling-org-apache-sling-scripting-sightly] branch master updated: SLING-9768 - The org.apache.sling.api.scripting.SlingScript#getScriptResource implementations should not leak the scripting resolver

[radu]

This is an automated email from the ASF dual-hosted git repository.

radu pushed a commit to branch master
in repository 
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-scripting-sightly.git


The following commit(s) were added to refs/heads/master by this push:
     new f34a9b3  SLING-9768 - The 
org.apache.sling.api.scripting.SlingScript#getScriptResource implementations 
should not leak the scripting resolver
f34a9b3 is described below

commit f34a9b32ee38193fe65235c3f36f66005e0889e7
Author: Radu Cotescu <r...@apache.org>
AuthorDate: Fri Sep 25 19:19:05 2020 +0200

    SLING-9768 - The 
org.apache.sling.api.scripting.SlingScript#getScriptResource implementations 
should not leak the scripting resolver
    
    * use the scripting resource resolver for solving dependencies related to 
the ScriptResource
---
 .../scripting/sightly/impl/utils/ScriptUtils.java  | 32 ++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git 
a/src/main/java/org/apache/sling/scripting/sightly/impl/utils/ScriptUtils.java 
b/src/main/java/org/apache/sling/scripting/sightly/impl/utils/ScriptUtils.java
index b6e66a1..64ce4ff 100644
--- 
a/src/main/java/org/apache/sling/scripting/sightly/impl/utils/ScriptUtils.java
+++ 
b/src/main/java/org/apache/sling/scripting/sightly/impl/utils/ScriptUtils.java
@@ -19,21 +19,49 @@ package org.apache.sling.scripting.sightly.impl.utils;
 import org.apache.sling.api.SlingHttpServletRequest;
 import org.apache.sling.api.resource.Resource;
 import org.apache.sling.api.resource.ResourceResolver;
+import org.apache.sling.api.resource.ResourceUtil;
 import org.apache.sling.api.scripting.SlingScriptHelper;
 import org.apache.sling.scripting.sightly.engine.ResourceResolution;
 import org.apache.sling.scripting.sightly.render.RenderContext;
+import org.jetbrains.annotations.NotNull;
 
 public class ScriptUtils {
 
+    private ScriptUtils() {}
+
     public static Resource resolveScript(ResourceResolver resolver, 
RenderContext renderContext, String scriptIdentifier) {
         SlingHttpServletRequest request = 
BindingsUtils.getRequest(renderContext.getBindings());
         Resource caller = ResourceResolution.getResourceForRequest(resolver, 
request);
         Resource result = ResourceResolution.getResourceFromSearchPath(caller, 
scriptIdentifier);
         if (result == null) {
             SlingScriptHelper sling = 
BindingsUtils.getHelper(renderContext.getBindings());
-            caller = sling.getScript().getScriptResource();
-            result = ResourceResolution.getResourceFromSearchPath(caller, 
scriptIdentifier);
+            if (sling != null) {
+                caller = getResource(resolver, 
sling.getScript().getScriptResource());
+                result = ResourceResolution.getResourceFromSearchPath(caller, 
scriptIdentifier);
+            }
         }
         return result;
     }
+
+    private static Resource getResource(@NotNull ResourceResolver resolver, 
@NotNull Resource resource) {
+        String path = resource.getPath();
+        if (path.startsWith("/")) {
+            Resource resolved = resolver.resolve(path);
+            if (ResourceUtil.isNonExistingResource(resolved)) {
+                return null;
+            }
+            return resolved;
+        } else {
+            for (String sp : resolver.getSearchPath()) {
+                String absolutePath = ResourceUtil.normalize(sp + path);
+                if (absolutePath != null) {
+                    Resource resolved = resolver.resolve(absolutePath);
+                    if (!ResourceUtil.isNonExistingResource(resolved)) {
+                        return resolved;
+                    }
+                }
+            }
+        }
+        return null;
+    }
 }