rootvector2 commented on code in PR #3626:
URL: https://github.com/apache/cxf/pull/3626#discussion_r4369831490
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/AbstractHTTPServlet.java:
##########
@@ -392,8 +396,36 @@ protected String getStaticResourceContentType(String
extension) {
return staticContentTypes.get(extension);
}
+ /**
+ * The container never serves WEB-INF or META-INF directly to a client,
but a RequestDispatcher
+ * and ServletContext.getResourceAsStream can reach them, so a request
path naming either
+ * directory is not forwarded or served as static content.
+ */
+ private static boolean isProtectedPath(String path) {
Review Comment:
Done. Added `static-resources-protected-path-list`, parsed the same way as
`static-resources-list`, defaulting to `(?i)/WEB-INF/.*` and
`(?i)/META-INF/.*`. So it now only matches a leading `WEB-INF`/`META-INF`, and
setting the parameter replaces the defaults. I kept the defaults
case-insensitive because `getResourceAsStream` on a case-insensitive filesystem
resolves `/web-inf/web.xml` too. Added a test for a custom list.
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/AbstractHTTPServlet.java:
##########
@@ -365,6 +365,10 @@ private static boolean matchPath(boolean checkRedirect,
List<Pattern> values, Ht
protected void serveStaticContent(HttpServletRequest request,
HttpServletResponse response,
String pathInfo) throws ServletException
{
+ if (isProtectedPath(pathInfo)) {
+ sendNotFound(response);
Review Comment:
Switched to `throw new ServletException("Static resource " + pathInfo + " is
not available")`, so a protected path fails the same way a missing resource
does.
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/AbstractHTTPServlet.java:
##########
@@ -392,8 +396,36 @@ protected String getStaticResourceContentType(String
extension) {
return staticContentTypes.get(extension);
}
+ /**
+ * The container never serves WEB-INF or META-INF directly to a client,
but a RequestDispatcher
+ * and ServletContext.getResourceAsStream can reach them, so a request
path naming either
+ * directory is not forwarded or served as static content.
+ */
+ private static boolean isProtectedPath(String path) {
+ if (path != null) {
+ for (String segment : path.split("/")) {
+ if ("WEB-INF".equalsIgnoreCase(segment) ||
"META-INF".equalsIgnoreCase(segment)) {
+ return true;
+ }
+ }
+ }
+ return false;
+ }
+
+ private static void sendNotFound(HttpServletResponse response) throws
ServletException {
+ try {
+ response.sendError(HttpServletResponse.SC_NOT_FOUND);
+ } catch (IOException ex) {
+ throw new ServletException(ex);
+ }
+ }
+
protected void redirect(HttpServletRequest request, HttpServletResponse
response, String pathInfo)
throws ServletException {
+ if (isProtectedPath(pathInfo)) {
Review Comment:
`redirect` doesn't go back through `serveStaticContent`. It calls
`sc.getRequestDispatcher(theServletPath + pathInfo)` and forwards to whatever
the container maps that path to, usually the JSP or default servlet, not CXF.
`forward`/`include` skip the container's `WEB-INF` check by design. So with
`redirects-list=/.*\.jsp`, `GET /services/WEB-INF/views/admin.jsp` gets
dispatched straight to `/WEB-INF/views/admin.jsp`. I hit that with the mocked
`RequestDispatcher` in `testRedirectUnderWebInfIsNotForwarded`. The check now
uses the same protected list and throws the same `No RequestDispatcher can be
created for path` `ServletException` as the existing failure path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
