[
https://issues.apache.org/jira/browse/CXF-9260?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andriy Redko resolved CXF-9260.
-------------------------------
Resolution: Fixed
> Reject WEB-INF and META-INF paths in AbstractHTTPServlet - #3626
> ----------------------------------------------------------------
>
> Key: CXF-9260
> URL: https://issues.apache.org/jira/browse/CXF-9260
> Project: CXF
> Issue Type: Improvement
> Affects Versions: 4.1.9, 4.2.4, 3.6.13
> Reporter: Andriy Redko
> Priority: Major
> Fix For: 3.6.14, 4.2.5, 4.1.10
>
>
> {{AbstractHTTPServlet.serveStaticContent}} and {{redirect}} hand the request
> {{pathInfo}} straight to {{ServletContext.getResourceAsStream}} and
> {{{}getRequestDispatcher{}}}, which unlike a direct client request can reach
> {{WEB-INF}} and {{{}META-INF{}}}, so a CXF servlet with
> {{static-resources-list}} or {{redirects-list}} configured serves
> {{/WEB-INF/web.xml}} or forwards to a {{/WEB-INF/views/*.jsp}} the container
> itself refuses to expose; found while reviewing the static-resource path
> handling, fixed by answering 404 inside both callees for any path with a
> {{WEB-INF}} or {{META-INF}} segment, with a regression test covering the
> static, forwarded and still-allowed cases.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
