Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

DispatcherPortlet's default resource serving explicitly prevents access to WEB-INF and META-INF (SPR-7540)

Browse Source
This commit is contained in:
Juergen Hoeller
2010-10-02 00:03:09 +00:00
parent aac2de9221
commit 40fa8afce4
4 changed files with 83 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
org.springframework.web.portlet/src/test/java/org/springframework/web/portlet/mvc/annotation/Portlet20AnnotationControllerTests.java
View File

@@ -33,6 +33,7 @@ import javax.portlet.PortletRequest;
import javax.portlet.PortletSession;
import javax.portlet.RenderRequest;
import javax.portlet.RenderResponse;
import javax.portlet.ResourceResponse;
import javax.portlet.StateAwareResponse;
import javax.portlet.WindowState;
import javax.servlet.http.Cookie;
@@ -117,6 +118,38 @@ public class Portlet20AnnotationControllerTests {
assertEquals("test", response.getContentAsString());
}
@Test
public void standardHandleMethodWithResources() throws Exception {
DispatcherPortlet portlet = new DispatcherPortlet() {
protected ApplicationContext createPortletApplicationContext(ApplicationContext parent) throws BeansException {
StaticPortletApplicationContext wac = new StaticPortletApplicationContext();
wac.setPortletConfig(getPortletConfig());
wac.registerBeanDefinition("controller", new RootBeanDefinition(MyController.class));
wac.refresh();
return wac;
}
};
portlet.init(new MockPortletConfig());
MockResourceRequest resourceRequest = new MockResourceRequest("/resource1");
MockResourceResponse resourceResponse = new MockResourceResponse();
portlet.serveResource(resourceRequest, resourceResponse);
assertEquals("/resource1", resourceResponse.getForwardedUrl());
assertNull(resourceResponse.getProperty(ResourceResponse.HTTP_STATUS_CODE));
resourceRequest = new MockResourceRequest("/WEB-INF/resource2");
resourceResponse = new MockResourceResponse();
portlet.serveResource(resourceRequest, resourceResponse);
assertNull(resourceResponse.getForwardedUrl());
assertEquals("404", resourceResponse.getProperty(ResourceResponse.HTTP_STATUS_CODE));
resourceRequest = new MockResourceRequest("/META-INF/resource3");
resourceResponse = new MockResourceResponse();
portlet.serveResource(resourceRequest, resourceResponse);
assertNull(resourceResponse.getForwardedUrl());
assertEquals("404", resourceResponse.getProperty(ResourceResponse.HTTP_STATUS_CODE));
}
@Test
public void adaptedHandleMethods() throws Exception {
doTestAdaptedHandleMethods(MyAdaptedController.class);