Eclipse
/
jetty.project
mirror of https://github.com/jetty/jetty.project.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Issue #8259 - AliasCheckers for different resource bases on same Context 

Signed-off-by: Lachlan Roberts <lachlan@webtide.com>
This commit is contained in:
Lachlan Roberts 2022-07-18 17:22:38 +10:00
parent 23df34e2d4
commit 6c35fc6f65
5 changed files with 183 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
jetty-server/src/main/java/org/eclipse/jetty/server/AllowedResourceAliasChecker.java
View File

@ -21,6 +21,7 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Objects;
import java.util.function.Supplier;
import org.eclipse.jetty.server.handler.ContextHandler;
import org.eclipse.jetty.util.component.AbstractLifeCycle;
@ -43,6 +44,7 @@ public class AllowedResourceAliasChecker extends AbstractLifeCycle implements Co
protected static final LinkOption[] NO_FOLLOW_LINKS = new LinkOption[]{LinkOption.NOFOLLOW_LINKS};
private final ContextHandler _contextHandler;
private final Supplier<Resource> _resourceBaseSupplier;
private final List<Path> _protected = new ArrayList<>();
private final AllowedResourceAliasCheckListener _listener = new AllowedResourceAliasCheckListener();
private boolean _initialized;
@ -52,8 +54,19 @@ public class AllowedResourceAliasChecker extends AbstractLifeCycle implements Co
* @param contextHandler the context handler to use.
*/
public AllowedResourceAliasChecker(ContextHandler contextHandler)
{
this(contextHandler, contextHandler::getBaseResource);
}
public AllowedResourceAliasChecker(ContextHandler contextHandler, Resource baseResource)
{
this(contextHandler, () -> baseResource);
}
public AllowedResourceAliasChecker(ContextHandler contextHandler, Supplier<Resource> resourceBaseSupplier)
{
_contextHandler = Objects.requireNonNull(contextHandler);
_resourceBaseSupplier = Objects.requireNonNull(resourceBaseSupplier);
}
protected ContextHandler getContextHandler()
@ -63,7 +76,7 @@ public class AllowedResourceAliasChecker extends AbstractLifeCycle implements Co
private void extractBaseResourceFromContext()
{
_base = getPath(_contextHandler.getBaseResource());
_base = getPath(_resourceBaseSupplier.get());
if (_base == null)
return;

6
jetty-server/src/main/java/org/eclipse/jetty/server/SymlinkAllowedResourceAliasChecker.java
View File

@ -18,6 +18,7 @@ import java.nio.file.Files;
import java.nio.file.Path;
import org.eclipse.jetty.server.handler.ContextHandler;
import org.eclipse.jetty.util.resource.Resource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@ -37,6 +38,11 @@ public class SymlinkAllowedResourceAliasChecker extends AllowedResourceAliasChec
super(contextHandler);
}
public SymlinkAllowedResourceAliasChecker(ContextHandler contextHandler, Resource baseResource)
{
super(contextHandler, baseResource);
}
@Override
protected boolean check(String pathInContext, Path path)
{

161
tests/test-integration/src/test/java/org/eclipse/jetty/test/AliasCheckerMultipleResourceBasesTest.java Normal file
View File

@ -0,0 +1,161 @@
//
// ========================================================================
// Copyright (c) 1995-2022 Mort Bay Consulting Pty Ltd and others.
//
// This program and the accompanying materials are made available under the
// terms of the Eclipse Public License v. 2.0 which is available at
// https://www.eclipse.org/legal/epl-2.0, or the Apache License, Version 2.0
// which is available at https://www.apache.org/licenses/LICENSE-2.0.
//
// SPDX-License-Identifier: EPL-2.0 OR Apache-2.0
// ========================================================================
//
package org.eclipse.jetty.test;
import java.io.File;
import java.net.URI;
import java.net.URL;
import java.nio.file.Files;
import java.nio.file.Path;
import org.eclipse.jetty.client.HttpClient;
import org.eclipse.jetty.client.api.ContentResponse;
import org.eclipse.jetty.http.HttpStatus;
import org.eclipse.jetty.server.Server;
import org.eclipse.jetty.server.ServerConnector;
import org.eclipse.jetty.server.SymlinkAllowedResourceAliasChecker;
import org.eclipse.jetty.server.handler.ContextHandler;
import org.eclipse.jetty.servlet.DefaultServlet;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;
import org.eclipse.jetty.util.IO;
import org.eclipse.jetty.util.resource.PathResource;
import org.eclipse.jetty.util.resource.Resource;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.is;
import static org.junit.jupiter.api.Assertions.assertNotNull;
public class AliasCheckerMultipleResourceBasesTest
{
private static Server _server;
private static ServerConnector _connector;
private static HttpClient _client;
private static ServletContextHandler _context;
private static Path _webRootPath;
private static Path _altDir1Symlink;
private static Path _altDir2Symlink;
private static Path getResource(String path) throws Exception
{
URL url = AliasCheckerMultipleResourceBasesTest.class.getClassLoader().getResource(path);
assertNotNull(url);
return new File(url.toURI()).toPath();
}
private static void delete(Path path)
{
IO.delete(path.toFile());
}
private static void setAliasCheckers(ContextHandler.AliasCheck... aliasChecks)
{
_context.clearAliasChecks();
if (aliasChecks != null)
{
for (ContextHandler.AliasCheck aliasCheck : aliasChecks)
{
_context.addAliasCheck(aliasCheck);
}
}
}
@BeforeAll
public static void beforeAll() throws Exception
{
_webRootPath = getResource("webroot");
_altDir1Symlink = _webRootPath.resolve("../altDir1Symlink");
delete(_altDir1Symlink);
Path altDir1 = _webRootPath.resolve("../altDir1").toAbsolutePath();
Files.createSymbolicLink(_altDir1Symlink, altDir1).toFile().deleteOnExit();
_altDir2Symlink = _webRootPath.resolve("../altDir2Symlink");
delete(_altDir2Symlink);
Path altDir2 = _webRootPath.resolve("../altDir2").toAbsolutePath();
Files.createSymbolicLink(_altDir2Symlink, altDir2).toFile().deleteOnExit();
// Create and start Server and Client.
_server = new Server();
_connector = new ServerConnector(_server);
_server.addConnector(_connector);
_context = new ServletContextHandler();
_context.setContextPath("/");
_context.setBaseResource(new PathResource(_webRootPath));
_context.setWelcomeFiles(new String[]{"index.html"});
_context.getMimeTypes().addMimeMapping("txt", "text/plain;charset=utf-8");
_server.setHandler(_context);
_context.clearAliasChecks();
_client = new HttpClient();
_client.start();
}
@AfterAll
public static void afterAll() throws Exception
{
Files.delete(_altDir1Symlink);
Files.delete(_altDir2Symlink);
_client.stop();
_server.stop();
}
@Test
public void test() throws Exception
{
System.err.println(_webRootPath.toAbsolutePath());
ServletHolder servletHolder;
servletHolder = _context.addServlet(DefaultServlet.class, "/defaultServlet1/*");
servletHolder.setInitParameter("resourceBase", _altDir1Symlink.toString());
servletHolder.setInitParameter("pathInfoOnly", "true");
servletHolder = _context.addServlet(DefaultServlet.class, "/defaultServlet2/*");
servletHolder.setInitParameter("resourceBase", _altDir2Symlink.toString());
servletHolder.setInitParameter("pathInfoOnly", "true");
setAliasCheckers(
new SymlinkAllowedResourceAliasChecker(_context, Resource.newResource(_altDir1Symlink)),
new SymlinkAllowedResourceAliasChecker(_context, Resource.newResource(_altDir2Symlink))
);
_server.start();
// Can access file 1 only through default servlet 1.
URI uri = URI.create("http://localhost:" + _connector.getLocalPort() + "/defaultServlet1/file1");
ContentResponse response = _client.GET(uri);
assertThat(response.getStatus(), is(HttpStatus.OK_200));
assertThat(response.getContentAsString(), is("file 1 contents"));
// File 2 cannot be found with default servlet 1.
uri = URI.create("http://localhost:" + _connector.getLocalPort() + "/defaultServlet1/file2");
response = _client.GET(uri);
assertThat(response.getStatus(), is(HttpStatus.NOT_FOUND_404));
// Can access file 2 only through default servlet 2.
uri = URI.create("http://localhost:" + _connector.getLocalPort() + "/defaultServlet2/file2");
response = _client.GET(uri);
assertThat(response.getStatus(), is(HttpStatus.OK_200));
assertThat(response.getContentAsString(), is("file 2 contents"));
// File 1 cannot be found with default servlet 2.
uri = URI.create("http://localhost:" + _connector.getLocalPort() + "/defaultServlet2/file1");
response = _client.GET(uri);
assertThat(response.getStatus(), is(HttpStatus.NOT_FOUND_404));
}
}

1
tests/test-integration/src/test/resources/altDir1/file1 Normal file
View File

@ -0,0 +1 @@
file 1 contents

1
tests/test-integration/src/test/resources/altDir2/file2 Normal file
View File

@ -0,0 +1 @@
file 2 contents