Spring/spring-webflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWF-604 - ResourceServlet allows http access to sensitive files.

Browse Source
This commit is contained in:
Jeremy Grelle
2008-04-15 22:12:20 +00:00
parent 33f9393137
commit 4427cfe55b
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java
View File

@@ -58,6 +58,8 @@ public class ResourceServlet extends HttpServlet {
private static final Log log = LogFactory.getLog(ResourceServlet.class);
private final String protectedPath = "/?WEB-INF/.*";
private boolean gzipEnabled = true;
private Map defaultMimeTypes = new HashMap();
@@ -213,6 +215,12 @@ public class ResourceServlet extends HttpServlet {
URL[] resources = new URL[localResourcePaths.length];
for (int i = 0; i < localResourcePaths.length; i++) {
String localResourcePath = localResourcePaths[i];
if (localResourcePath.matches(protectedPath)) {
if (log.isWarnEnabled()) {
log.warn("An attempt to access a protected resource at " + localResourcePath + " was disallowed.");
}
return null;
}
URL resource = getServletContext().getResource(localResourcePath);
if (resource == null) {
String jarResourcePath = "META-INF" + localResourcePath;