rootvector2 opened a new pull request, #3626: URL: https://github.com/apache/cxf/pull/3626
`AbstractHTTPServlet.serveStaticContent` and `redirect` hand the request `pathInfo` straight to `ServletContext.getResourceAsStream` and `getRequestDispatcher`, which unlike a direct client request can reach `WEB-INF` and `META-INF`, so a CXF servlet with `static-resources-list` or `redirects-list` configured serves `/WEB-INF/web.xml` or forwards to a `/WEB-INF/views/*.jsp` the container itself refuses to expose; found while reviewing the static-resource path handling, fixed by answering 404 inside both callees for any path with a `WEB-INF` or `META-INF` segment, with a regression test covering the static, forwarded and still-allowed cases. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
