[jira] [Updated] (TAP5-1005) The asset protection fails for some URLS in Tomcat

["Ulrich Stärk (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TAP5-1005?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Ulrich Stärk updated TAP5-1005:
-------------------------------

    Labels: bulk-close-candidate  (was: )

This issue has been last updated more than 1.5 years ago, has no assignee, affects an old version of Tapestry that is not actively developed anymore, and is therefore prone to be bulk-closed in the near future.

If the issue still persists with the most recent development preview of Tapestry, please update it as soon as possible. In the case of a feature request, please discuss it with the Tapestry developer community on the dev@tapestry.apache.org mailing list first.
                
> The asset protection fails for some URLS in Tomcat
> --------------------------------------------------
>
>                 Key: TAP5-1005
>                 URL: https://issues.apache.org/jira/browse/TAP5-1005
>             Project: Tapestry 5
>          Issue Type: Bug
>          Components: tapestry-core
>    Affects Versions: 5.1.0.6, 5.1.0.7
>            Reporter: Sebastian Hennebrueder
>              Labels: bulk-close-candidate
>
> A URL like
> /mycontext/assets/de displays a file index on Tomcat 6 whereas /mycontext/assets/de/ denies access correctly.
> In fact any URL which is not a file and does not end with a / leeds to a directory index.
> I fixed this with a BlackListAuthorizer for my application.
> The URL /mycontext/assets/de leads to an empty 'someResourcePath' variable
> /mycontext/assets/de/foo leads to de/foo as variable value. My solution denies access for an empty resource path and in case that the last segment has no . I assume that in that case it is not a file like foo.jpg.
> Best Regards
> Sebastian Hennebrueder
> http://www.laliluna.de
> public class BlacklistAuthorizer implements AssetPathAuthorizer {
> 	final Logger logger = LoggerFactory.getLogger(BlacklistAuthorizer.class);
> 	private final Collection<String> configuration;
> 	public BlacklistAuthorizer(final Collection<String> configuration) {
> 		this.configuration = configuration;
> 	}
> 	public boolean accessAllowed(final String someResourcePath) {
> 		return true;
> 	}
> 	public boolean accessDenied(final String someResourcePath) {
> 		if (someResourcePath.endsWith("/")) {
> 			logger.debug("Denying access to {}", someResourcePath);
> 			return true;
> 		}
> 		if (someResourcePath.equals("")) {
> 			// this is mostly a bug fix for Tomcat for paths without trailing / like /assets/foo
> 			logger.debug("Denying access to empty resource path", someResourcePath);
> 			return true;
> 		}
> 		int pos = someResourcePath.lastIndexOf('/');
> 		if (pos < 0)
> 			pos = 0;
> 		String ending = someResourcePath.substring(pos);
> 		if (ending.indexOf('.') == -1) {
> 			// not a file like foo.pdf or foo.js
> 			logger.debug("Denying access to {}", someResourcePath);
> 			return true;
> 		}
> 		return false;
> 	}
> 	public List<Order> order() {
> 		return Arrays.asList(Order.DENY, Order.ALLOW);
> 	}
> }

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira