That is precisely what I'm trying to avoid, having to explicitly list each and every unprotected asset. For something like dojo this just isn't a reasonable way of doing it.
Ideally I'd like to see a solution that disallows mucking around with paths to get access to things, and also has inuitive defaults. Like making .css/.js/.html files unprotected by default. I'm always a fan of more comlicated logic within the framework that allows the user to do as little as possible to get up and running. In that vein, maybe an easier solution would be 2 configuration points: <configuration GloballySafeAssets> <asset extension="css" /> <asset extension="js" /> <asset extension="html" /> <asset extension="htm" /> </configuration> <configuration UnprotectedAssets> <unprotected-assets path="/net/sf/tacos/ajax" /> </configuration> This configuration would allow security logic to ensure proper paths AND provide sensible defaults for unprotected resources, when people choose to enable them. Thoughts? jesse > > /net/sf/tacos/ajax/dojo/dojo.js > > /net/sf/tacos/ajax/dojo/src/bootstrap.js > > /net/sf/tacos/ajax/dojo/src/etc.... > > You can define an asset for every one of those, and unprotect it. > The fact that you are not directly using the assets does not concern > tapestry... > > as before - i am much more in favour of the asset way, more simple > control... (more ->, simple, control). > > > > > To get around the only major haxor flaw that I can see, which is using > > ../../ to move around the paths we could go with something more like: > > > > <configuration foo..> > > <unprotected-resource path="/net/sf/tacos/ajax/components/" > contains=".*.js" > > /> > > </configuration> > > breaking it to a path and filename wildcard sounds good. > you will however check it after you have accessed the resource. >
