(tapestry-5) branch master updated: Revert "Improving context asset handling"

[thiagohp]

This is an automated email from the ASF dual-hosted git repository.

thiagohp pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/tapestry-5.git


The following commit(s) were added to refs/heads/master by this push:
     new 3fb5bd602 Revert "Improving context asset handling"
3fb5bd602 is described below

commit 3fb5bd60231b103d0c53aea7d3a92544421c888e
Author: Thiago H. de Paula Figueiredo <thi...@arsmachina.com.br>
AuthorDate: Sat Oct 3 09:09:18 2026 -0300

    Revert "Improving context asset handling"
    
    This reverts commit e9e0b7e7ad589ac9dd433168d34145620ffa0f9f.
---
 .../assets/ContextAssetRequestHandler.java         | 42 ++--------------------
 1 file changed, 3 insertions(+), 39 deletions(-)

diff --git 
a/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/assets/ContextAssetRequestHandler.java
 
b/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/assets/ContextAssetRequestHandler.java
index 5f30c37ed..1ba8e007f 100644
--- 
a/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/assets/ContextAssetRequestHandler.java
+++ 
b/tapestry-core/src/main/java/org/apache/tapestry5/internal/services/assets/ContextAssetRequestHandler.java
@@ -20,8 +20,6 @@ import org.apache.tapestry5.http.services.Response;
 import org.apache.tapestry5.internal.services.ResourceStreamer;
 import org.apache.tapestry5.services.ContextAssetProtectionRule;
 import org.apache.tapestry5.services.assets.AssetRequestHandler;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 import java.util.regex.Pattern;
@@ -34,8 +32,6 @@ import java.util.regex.Pattern;
  */
 public class ContextAssetRequestHandler implements AssetRequestHandler
 {
-    private final static Logger LOGGER = 
LoggerFactory.getLogger(ContextAssetRequestHandler.class);
-
     private final ResourceStreamer resourceStreamer;
 
     private final Resource rootContextResource;
@@ -56,50 +52,18 @@ public class ContextAssetRequestHandler implements 
AssetRequestHandler
     {
         ChecksumPath path = new ChecksumPath(resourceStreamer, null, 
extraPath);
 
-        // Resolve the resource first, then check the protection rule against 
the
-        // fully-normalized path that will actually be loaded and streamed 
(Resource#getPath()).
-        final Resource resource;
-
-        try
-        {
-            resource = rootContextResource.forFile(path.resourcePath);
-        }
-        catch (IllegalStateException ex)
-        {
-            // The path normalized to a location above the context root (a 
"../" escape).
-            // Fail closed: treat it as blocked rather than surfacing it as a 
server error.
-            if (LOGGER.isWarnEnabled())
-            {
-                LOGGER.warn("Blocked request for context asset '" + 
path.resourcePath +
-                        "': " + ex.getMessage());
-            }
-            return false;
-        }
-
-        final String resourcePath = resource.getPath();
-
-        if (illegal.matcher(resourcePath).matches())
+        if (illegal.matcher(path.resourcePath).matches())
         {
-            if (LOGGER.isWarnEnabled())
-            {
-                LOGGER.warn("Blocked request for context asset '" + 
resourcePath +
-                        "': the path resolves to a protected location 
(WEB-INF, META-INF or a template).");
-            }
             return false;
         }
 
         // TAP5-2835: Allow custom protection rules mirroring 
ClasspathAssetProtectionRule
-        if (contextAssetProtectionRule.block(resourcePath))
+        if (contextAssetProtectionRule.block(path.resourcePath))
         {
-            if (LOGGER.isWarnEnabled())
-            {
-                LOGGER.warn("Blocked request for context asset '" + 
resourcePath +
-                        "'. Contribute a new ContextAssetProtectionRule if you 
need this asset to be publicly accessible.");
-            }
             return false;
         }
 
-        return path.stream(resource);
+        return path.stream(rootContextResource.forFile(path.resourcePath));
     }
 
 }