This is an automated email from the ASF dual-hosted git repository.
bitstorm pushed a commit to branch wicket-10.x
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/wicket-10.x by this push:
new 4211a1cf49 restrict SourcesPage to resources of the page's own package
(#1523)
4211a1cf49 is described below
commit 4211a1cf491bd6a4ea7f66c3feb0e1f0084be622
Author: Farkhalit Rida <[email protected]>
AuthorDate: Tue Aug 18 03:05:08 2026 +0530
restrict SourcesPage to resources of the page's own package (#1523)
---
.../apache/wicket/examples/source/SourcesPage.java | 16 ++++-
.../wicket/examples/source/SourcesPageTest.java | 68 ++++++++++++++++++++++
2 files changed, 82 insertions(+), 2 deletions(-)
diff --git
a/wicket-examples/src/main/java/org/apache/wicket/examples/source/SourcesPage.java
b/wicket-examples/src/main/java/org/apache/wicket/examples/source/SourcesPage.java
index 69f754bc3b..a8dc03e902 100644
---
a/wicket-examples/src/main/java/org/apache/wicket/examples/source/SourcesPage.java
+++
b/wicket-examples/src/main/java/org/apache/wicket/examples/source/SourcesPage.java
@@ -101,6 +101,12 @@ public class SourcesPage extends WebPage
try
{
source = (name != null) ? name :
sourceParam.toString();
+ if
(!packagedResources.getObject().contains(source))
+ {
+ log.error("user is trying to access
resource: {} which is not part of the package of {}",
+ source,
getPageTargetClass().getName());
+ return "Unable to read the source for "
+ source;
+ }
resourceAsStream =
getPageTargetClass().getResourceAsStream(source);
if (resourceAsStream == null)
{
@@ -198,7 +204,7 @@ public class SourcesPage extends WebPage
}
else
{
- String absolutePath =
scope.getResource("").toExternalForm();
+ String absolutePath =
resource.toExternalForm();
File basedir;
URI uri;
try
@@ -290,7 +296,7 @@ public class SourcesPage extends WebPage
private FilesBrowser(String id)
{
super(id);
- ListView<String> lv = new ListView<String>("file", new
PackagedResourcesModel())
+ ListView<String> lv = new ListView<String>("file",
packagedResources)
{
@Override
protected void populateItem(final
ListItem<String> item)
@@ -377,6 +383,12 @@ public class SourcesPage extends WebPage
*/
private String name;
+ /**
+ * The resources of the package of the selected page. Doubles as the
white list of what may be
+ * displayed.
+ */
+ private final PackagedResourcesModel packagedResources = new
PackagedResourcesModel();
+
private transient Class<? extends Page> page;
/**
diff --git
a/wicket-examples/src/test/java/org/apache/wicket/examples/source/SourcesPageTest.java
b/wicket-examples/src/test/java/org/apache/wicket/examples/source/SourcesPageTest.java
new file mode 100644
index 0000000000..bc505a5540
--- /dev/null
+++
b/wicket-examples/src/test/java/org/apache/wicket/examples/source/SourcesPageTest.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wicket.examples.source;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.apache.wicket.examples.helloworld.HelloWorld;
+import org.apache.wicket.request.mapper.parameter.PageParameters;
+import org.apache.wicket.util.tester.WicketTestCase;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Tests for {@link SourcesPage}.
+ */
+public class SourcesPageTest extends WicketTestCase
+{
+ private String render(String source)
+ {
+ PageParameters parameters =
SourcesPage.generatePageParameters(HelloWorld.class, source);
+ tester.startPage(SourcesPage.class, parameters);
+ return tester.getLastResponseAsString();
+ }
+
+ /**
+ * A resource of the package of the requested page is displayed.
+ */
+ @Test
+ public void sourceOfThePackageIsDisplayed()
+ {
+ assertFalse(render("HelloWorld.html").contains("Unable to read
the source for"));
+ }
+
+ /**
+ * An absolute class path resource outside of the package of the
requested page is refused.
+ */
+ @Test
+ public void absoluteClassPathResourceIsRefused()
+ {
+ String response = render("/META-INF/NOTICE");
+ assertFalse(response.contains("Apache Software Foundation
(http"));
+ assertTrue(response.contains("Unable to read the source for"));
+ }
+
+ /**
+ * A parent directory reference is refused.
+ */
+ @Test
+ public void parentDirectoryResourceIsRefused()
+ {
+ String response = render("../style.css");
+ assertTrue(response.contains("Unable to read the source for"));
+ }
+}
