mattcasters opened a new pull request, #8306:
URL: https://github.com/apache/hop/pull/8306
Opening `.html` / `.htm` in the File Explorer on **Hop Web** used
`Browser.setText()`. The RAP iframe has no document URL, so relative CSS,
images, scripts, and links resolved against `/ui` and 404'd. PDFs used a
server-side `file:` URL that the user's browser cannot fetch.
A query-only RAP `ServiceHandler` URL would not fix this: RFC 3986 drops the
query when resolving path-relative `href`/`src`. The iframe needs a **directory
base**.
## What changed
Serve allow-listed files at a path-shaped URL:
```
{contextPath}/explorer-file/{token}/{relative/path/from/explorer/root}
```
- HTML and PDF explorer tabs call `Browser.setUrl()` with that path on Hop
Web.
- File I/O runs inside the RAP `UISession` (HopVfs namespaces are
session-scoped).
- The URL stays origin-relative (no `request.getRequestURL()`), so TLS
reverse proxies do not mixed-content-block the iframe.
- Desktop uses `file:` / `http(s)` `setUrl` so SWT also has a document base.
- `http(s)` filenames still use `setUrl` unchanged.
## Security
The servlet is reachable from the user's browser and must not become an
arbitrary file read:
- Opaque per-session UUID token bound to the RAP UI session and HTTP session
- Paths sandboxed to the current explorer root (reject `..`, absolute paths,
schemes)
- Allow-listed extensions only (`html`, `css`, `js`, images, fonts, `pdf`, …)
- Explorer max file size (default 16MB)
- `X-Content-Type-Options: nosniff`, `Cache-Control: private, no-store`
## Tests
- `ExplorerFileServingTest`: path sandbox, content types, nested
`../../assets/css/x.css` join, public path never starts with `http`
- `ExplorerFileServletTest`: 200 for HTML/CSS under the root; 404 for bad
token, session mismatch, traversal, unknown extension
- `hop-ui-rap` unit tests pass (89)
Fixes #8297
------------------------
Thank you for your contribution! Follow this checklist to help us
incorporate your contribution quickly and easily:
- [ ] Run `mvn clean install apache-rat:check` to make sure basic checks
pass. A more thorough check will be performed on your pull request
automatically.
- [x] If you have a group of commits related to the same change, please
squash your commits into one and force push your branch using `git rebase -i`.
- [x] Mention the appropriate issue in your description (for example:
`addresses #123`), if applicable.
To make clear that you license your contribution under the [Apache License
Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
you have to acknowledge this by using the following check-box.
- [x] I hereby declare this contribution to be licensed under the [Apache
License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0)
- [ ] In any other case, please file an [Apache Individual Contributor
License Agreement](https://www.apache.org/licenses/icla.pdf).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
