reta commented on code in PR #3626:
URL: https://github.com/apache/cxf/pull/3626#discussion_r4368852089
##########
rt/transports/http/src/main/java/org/apache/cxf/transport/servlet/AbstractHTTPServlet.java:
##########
@@ -392,8 +396,36 @@ protected String getStaticResourceContentType(String
extension) {
return staticContentTypes.get(extension);
}
+ /**
+ * The container never serves WEB-INF or META-INF directly to a client,
but a RequestDispatcher
+ * and ServletContext.getResourceAsStream can reach them, so a request
path naming either
+ * directory is not forwarded or served as static content.
+ */
+ private static boolean isProtectedPath(String path) {
+ if (path != null) {
+ for (String segment : path.split("/")) {
+ if ("WEB-INF".equalsIgnoreCase(segment) ||
"META-INF".equalsIgnoreCase(segment)) {
+ return true;
+ }
+ }
+ }
+ return false;
+ }
+
+ private static void sendNotFound(HttpServletResponse response) throws
ServletException {
+ try {
+ response.sendError(HttpServletResponse.SC_NOT_FOUND);
+ } catch (IOException ex) {
+ throw new ServletException(ex);
+ }
+ }
+
protected void redirect(HttpServletRequest request, HttpServletResponse
response, String pathInfo)
throws ServletException {
+ if (isProtectedPath(pathInfo)) {
Review Comment:
Why do we need special handling for redirect? Shouldn't it end up in
`serveStaticContent` anyway post redirect?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
