reta commented on code in PR #3626:
URL: https://github.com/apache/cxf/pull/3626#discussion_r4368845959
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/AbstractHTTPServlet.java:
##########
@@ -392,8 +396,36 @@ protected String getStaticResourceContentType(String
extension) {
return staticContentTypes.get(extension);
}
+ /**
+ * The container never serves WEB-INF or META-INF directly to a client,
but a RequestDispatcher
+ * and ServletContext.getResourceAsStream can reach them, so a request
path naming either
+ * directory is not forwarded or served as static content.
+ */
+ private static boolean isProtectedPath(String path) {
Review Comment:
Thanks @rootvector2 , this is a good finding and could improve CXF security
posture, a few suggestions please: let's introduce
`static-resources-protected-path-list` (pattern) with default to be set to
`/WEB-INF/*.`, `/META-INF/*.`, it will help customize the rule and also make it
more precise (right now we do find any segment that matches WEB-INF or
META-INF, which looks too restrictive)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
