[
https://issues.apache.org/jira/browse/WICKET-4431?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sebastiaan van Erk updated WICKET-4431:
---------------------------------------
Comment: was deleted
(was: I don't really understand how this is a duplicate of WICKET-4430. The
problem I'm pointing to in this case is the fact that the / of the servlet
context directory is added to the directories searched for resources by default
and there is no explicit protection to avoid accessing resources in the WEB-INF
directory. This is a different problem then the scoping problem.
That is, the constructor of the WebApplicationPath is as follows:
public WebApplicationPath(final ServletContext servletContext)
{
this.servletContext = servletContext;
// adding root so servlet context resources are always checked
webappPaths.add("/");
}
and an instance of this class is used as a default resource finder.)
> Possible to retrieve files from WEB-INF (e.g., web.xml).
> --------------------------------------------------------
>
> Key: WICKET-4431
> URL: https://issues.apache.org/jira/browse/WICKET-4431
> Project: Wicket
> Issue Type: Bug
> Components: wicket
> Affects Versions: 1.5.4
> Reporter: Sebastiaan van Erk
> Assignee: Peter Ertl
> Priority: Critical
>
> The following URL works to get the web.xml from the WEB-INF directory:
> http://localhost:8080/wicket/resource/int/WEB-INF/web.xml
> This is because the WebApplicationPath constructor by default adds / allowing
> us to access the resources from the servlet context.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
