From b7e5df3438a298b60447950ce57944dc7babc8ae Mon Sep 17 00:00:00 2001 From: Jeremy Grelle Date: Thu, 5 Jun 2008 21:43:24 +0000 Subject: [PATCH] SWF-706 - ResourceServlet allows HTTP access to sensitive files --- .../js/resource/ResourceServlet.java | 16 ++++++++++------ .../js/resource/ResourceServletTests.java | 13 ------------- 2 files changed, 10 insertions(+), 19 deletions(-) diff --git a/spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java b/spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java index a94964bf..caa2a423 100644 --- a/spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java +++ b/spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java @@ -35,7 +35,9 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; +import org.springframework.util.AntPathMatcher; import org.springframework.util.ClassUtils; +import org.springframework.util.PathMatcher; import org.springframework.util.StringUtils; import org.springframework.web.servlet.HttpServletBean; @@ -248,12 +250,14 @@ public class ResourceServlet extends HttpServletBean { if (resourcePath.matches(protectedPath)) { return false; } - /* - * PathMatcher pathMatcher = new AntPathMatcher(); for (int i = 0; i < allowedResourcePaths.length; i++) { - * String pattern = allowedResourcePaths[i]; if (pathMatcher.match(pattern, resourcePath)) { return true; } } - * return false; - */ - return true; + PathMatcher pathMatcher = new AntPathMatcher(); + for (int i = 0; i < allowedResourcePaths.length; i++) { + String pattern = allowedResourcePaths[i]; + if (pathMatcher.match(pattern, resourcePath)) { + return true; + } + } + return false; } /** diff --git a/spring-js/src/test/java/org/springframework/js/resource/ResourceServletTests.java b/spring-js/src/test/java/org/springframework/js/resource/ResourceServletTests.java index 4a60212a..9c7353c5 100644 --- a/spring-js/src/test/java/org/springframework/js/resource/ResourceServletTests.java +++ b/spring-js/src/test/java/org/springframework/js/resource/ResourceServletTests.java @@ -75,19 +75,6 @@ public class ResourceServletTests extends TestCase { assertEquals(404, response.getStatus()); } - public final void testBenchmark() throws Exception { - String requestPath = "/dojo/dojo.js"; - - // for (int i = 0; i < 100; i++) { - // request = new MockHttpServletRequest(); - // response = new MockHttpServletResponse(); - request.setPathInfo(requestPath); - servlet.doGet(request, response); - - assertEquals(200, response.getStatus()); - // } - } - private class ResourceTestMockServletContext extends MockServletContext { public String getMimeType(String filePath) {