Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ResourceHttpRequestHandler detects invalid directory traversal in given path (SPR-8515)

Browse Source
This commit is contained in:
Juergen Hoeller
2011-07-25 10:57:39 +00:00
parent 037497cb4f
commit 41b9a461df
2 changed files with 33 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
org.springframework.web.servlet/src/test/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandlerTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2010 the original author or authors.
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,7 +20,6 @@ import java.util.ArrayList;
import java.util.List;
import javax.servlet.http.HttpServletResponse;
import static org.junit.Assert.*;
import org.junit.Before;
import org.junit.Test;
@@ -32,6 +31,8 @@ import org.springframework.mock.web.MockServletContext;
import org.springframework.web.HttpRequestMethodNotSupportedException;
import org.springframework.web.servlet.HandlerMapping;
import static org.junit.Assert.*;
/**
* @author Keith Donald
* @author Jeremy Grelle
@@ -119,6 +120,22 @@ public class ResourceHttpRequestHandlerTests {
assertEquals("function foo() { console.log(\"hello world\"); }", response.getContentAsString());
}
@Test
public void getResourceViaDirectoryTraversal() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
request.setMethod("GET");
request.setAttribute(HandlerMapping.PATH_WITHIN_HANDLER_MAPPING_ATTRIBUTE, "../testsecret/secret.txt");
MockHttpServletResponse response = new MockHttpServletResponse();
handler.handleRequest(request, response);
assertEquals(404, response.getStatus());
request.setAttribute(HandlerMapping.PATH_WITHIN_HANDLER_MAPPING_ATTRIBUTE, "test/../../testsecret/secret.txt");
response = new MockHttpServletResponse();
handler.handleRequest(request, response);
assertEquals(404, response.getStatus());
}
@Test
public void notModified() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();