Spring/spring-webflow
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SWF-706 - ResourceServlet allows HTTP access to sensitive files

Browse Source
This commit is contained in:
Jeremy Grelle
2008-06-05 21:43:24 +00:00
parent 31d1425347
commit b7e5df3438
2 changed files with 10 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
spring-js/src/main/java/org/springframework/js/resource/ResourceServlet.java
View File

@@ -35,7 +35,9 @@ import javax.servlet.http.HttpServletResponse;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.AntPathMatcher;
import org.springframework.util.ClassUtils;
import org.springframework.util.PathMatcher;
import org.springframework.util.StringUtils;
import org.springframework.web.servlet.HttpServletBean;
@@ -248,12 +250,14 @@ public class ResourceServlet extends HttpServletBean {
if (resourcePath.matches(protectedPath)) {
return false;
}
/*
* PathMatcher pathMatcher = new AntPathMatcher(); for (int i = 0; i < allowedResourcePaths.length; i++) {
* String pattern = allowedResourcePaths[i]; if (pathMatcher.match(pattern, resourcePath)) { return true; } }
* return false;
*/
return true;
PathMatcher pathMatcher = new AntPathMatcher();
for (int i = 0; i < allowedResourcePaths.length; i++) {
String pattern = allowedResourcePaths[i];
if (pathMatcher.match(pattern, resourcePath)) {
return true;
}
}
return false;
}
/**