pjfanning opened a new pull request, #1406: URL: https://github.com/apache/pekko-http/pull/1406
### Motivation `getFromResource` passes the resource name to the class loader as given, so a name built from request input, for example `getFromResource(s"public/$name")`, can resolve to a resource outside the intended prefix through a `..` segment. #1263 documented this; for 2.0.0 the directive can reject such names by default instead, with a setting to restore the old behaviour for anyone who relies on it. ### Modification - `getFromResource` rejects a resource name that contains a `..` segment, a backslash or a NUL character, and logs a warning that names the new setting. - New setting `pekko.http.routing.reject-unsafe-resource-names` (default `on`), exposed on the Scala and Java `RoutingSettings`. `off` restores the 1.x behaviour, for the whole application or for part of a route via `withSettings`. - `getFromResourceDirectory` calls through `getFromResource`, so a `..` in its directory argument is now rejected too. A `.` segment and ordinary names are still served. - Scaladoc (Scala and Java DSL), the `getFromResource` directive page and the 1.x → 2.x migration guide are updated. - MiMa filters for the two new abstract `RoutingSettings` members, following the `use-jar-file-cache` precedent. The directive still does not know which prefix a name was built from, so the docs keep recommending validating request-derived input or using `getFromResourceDirectory`. ### Result `getFromResource` no longer resolves `..` segments by default. Names containing `..` only resolved against directory-backed class loaders anyway, not against resources inside jar files. ### Tests - `sbt "http-tests/testOnly org.apache.pekko.http.scaladsl.server.directives.FileAndResourceDirectivesSpec"` (57 passed). New tests check rejection of `..`, backslash and NUL names, that a `.` segment is still served, and that the same `..` name is served when the setting is off. - `sbt "http/mimaReportBinaryIssues"` passes. - Native `scalafmt` run on the changed Scala files. ### References Follow-up to #1263 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
