Andriy Redko created CXF-9260:
---------------------------------
Summary: Reject WEB-INF and META-INF paths in AbstractHTTPServlet
- #3626
Key: CXF-9260
URL: https://issues.apache.org/jira/browse/CXF-9260
Project: CXF
Issue Type: Improvement
Reporter: Andriy Redko
{{AbstractHTTPServlet.serveStaticContent}} and {{redirect}} hand the request
{{pathInfo}} straight to {{ServletContext.getResourceAsStream}} and
{{{}getRequestDispatcher{}}}, which unlike a direct client request can reach
{{WEB-INF}} and {{{}META-INF{}}}, so a CXF servlet with
{{static-resources-list}} or {{redirects-list}} configured serves
{{/WEB-INF/web.xml}} or forwards to a {{/WEB-INF/views/*.jsp}} the container
itself refuses to expose; found while reviewing the static-resource path
handling, fixed by answering 404 inside both callees for any path with a
{{WEB-INF}} or {{META-INF}} segment, with a regression test covering the
static, forwarded and still-allowed cases.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
