[jira] [Commented] (SLING-3482) Synthetic resources should lead to a 404

["Nan Fan (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SLING-3482?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13961316#comment-13961316 ] 

Nan Fan commented on SLING-3482:
--------------------------------

Hi, I found this change will cause at least one problem that resource.path in esp script returns '<name>.<selector>.<extension>' for Synthetic resources:

var path = resource.path;

for example, it will return '/libs.explorer.node.html' if current url is '/libs.explorer.node.html' and '/libs' is synthetic resource (the code above is in bundles/extensions/explorer/src/main/resources/libs/sling/servlet/default/explorer/node.esp)

And, I also did a test that if I package a resource which parent folder does not exist previously in a bundle. 

<Sling-Bundle-Resources>/apps/newfolder1/myres1</Sling-Bundle-Resources>

It does return 404 if I visit '/apps/newfolder.json' but it returns resource json by '/apps/newfolder/myres1.json' in example below, this is expected but this also causes myres1 not navigatable from '/apps.infinity.json'.


> Synthetic resources should lead to a 404
> ----------------------------------------
>
>                 Key: SLING-3482
>                 URL: https://issues.apache.org/jira/browse/SLING-3482
>             Project: Sling
>          Issue Type: Bug
>          Components: ResourceResolver
>    Affects Versions: Resource Resolver 1.0.6
>            Reporter: Carsten Ziegeler
>            Assignee: Carsten Ziegeler
>             Fix For: Resource Resolver 1.1.0
>
>
> If e.g. /libs is requested by a user who does not have access to /libs, a synthetic resource for libs is returned which is then rendered.
> This is due to the special handling for servlet resources which are mounted at /libs/....
> I think the code in ResourceProviderEntry#getInternalResource is too generic:
>             if (entries.size() > 0 && entries.size() == elements.length) {
>                 if (entries.get(entries.size() - 1).getResourceProviders().length == 0) {
>                     logger.debug("Resolved Synthetic {}", fullPath);
>                     return new SyntheticResource(resourceResolver, fullPath, ResourceProvider.RESOURCE_TYPE_SYNTHETIC);
>                 }
>             }
> However, fixing this might break other parts like the servlet resolver relying on it



--
This message was sent by Atlassian JIRA
(v6.2#6252)