Skip to content

Commit ea0c5d3

Browse files
gae-java-botgae-java-bot
committed
Fixes for ResourceFileServlet
PiperOrigin-RevId: 746271054 Change-Id: Id5c416fa507630899049ad18bd0e18addc5fbfea
1 parent 3f0cf2c commit ea0c5d3

File tree

2 files changed

+59
-58
lines changed

2 files changed

+59
-58
lines changed

‎runtime/runtime_impl_jetty12/src/main/java/com/google/apphosting/runtime/jetty/ee10/ResourceFileServlet.java

+29-29
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,8 @@
3333
import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
3434
import org.eclipse.jetty.ee10.servlet.ServletHandler;
3535
import org.eclipse.jetty.ee10.servlet.ServletMapping;
36+
import org.eclipse.jetty.server.AliasCheck;
37+
import org.eclipse.jetty.server.AllowedResourceAliasChecker;
3638
import org.eclipse.jetty.server.handler.ContextHandler;
3739
import org.eclipse.jetty.util.StringUtil;
3840
import org.eclipse.jetty.util.URIUtil;
@@ -59,6 +61,7 @@ public class ResourceFileServlet extends HttpServlet {
5961
private Resource resourceBase;
6062
private String[] welcomeFiles;
6163
private FileSender fSender;
64+
private AliasCheck aliasCheck;
6265
ServletContextHandler chandler;
6366
ServletContext context;
6467
String defaultServletName;
@@ -90,6 +93,11 @@ public void init() throws ServletException {
9093
try {
9194
URL resourceBaseUrl = context.getResource("/" + appVersion.getPublicRoot());
9295
resourceBase = (resourceBaseUrl == null) ? null : ResourceFactory.of(chandler).newResource(resourceBaseUrl);
96+
if (resourceBase != null) {
97+
ContextHandler contextHandler = ServletContextHandler.getServletContextHandler(context);
98+
contextHandler.addAliasCheck(new AllowedResourceAliasChecker(contextHandler, resourceBase));
99+
aliasCheck = contextHandler;
100+
}
93101
} catch (Exception ex) {
94102
throw new ServletException(ex);
95103
}
@@ -162,41 +170,32 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
162170
}
163171

164172
// Find the resource
165-
Resource resource = null;
166-
try {
167-
resource = getResource(pathInContext);
173+
Resource resource = getResource(pathInContext);
174+
if (resource == null) {
175+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
176+
return;
177+
}
168178

169-
if (resource == null) {
170-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
171-
return;
172-
}
179+
if (StringUtil.endsWithIgnoreCase(resource.getName(), ".jsp")) {
180+
// General paranoia: don't ever serve raw .jsp files.
181+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
182+
return;
183+
}
173184

174-
if (StringUtil.endsWithIgnoreCase(resource.getName(), ".jsp")) {
175-
// General paranoia: don't ever serve raw .jsp files.
176-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
177-
return;
185+
// Handle resource
186+
if (resource.isDirectory()) {
187+
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
188+
response.sendError(HttpServletResponse.SC_FORBIDDEN);
178189
}
179-
180-
// Handle resource
181-
if (resource.isDirectory()) {
182-
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
183-
response.sendError(HttpServletResponse.SC_FORBIDDEN);
184-
}
190+
} else {
191+
if (!resource.exists() || !aliasCheck.checkAlias(pathInContext, resource)) {
192+
logger.atWarning().log("Non existent resource: %s = %s", pathInContext, resource);
193+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
185194
} else {
186-
if (resource == null || !resource.exists()) {
187-
logger.atWarning().log("Non existent resource: %s = %s", pathInContext, resource);
188-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
189-
} else {
190-
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
191-
fSender.sendData(context, response, included, resource, request.getRequestURI());
192-
}
195+
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
196+
fSender.sendData(context, response, included, resource, request.getRequestURI());
193197
}
194198
}
195-
} finally {
196-
if (resource != null) {
197-
// TODO: do we need to release.
198-
// resource.release();
199-
}
200199
}
201200
}
202201

@@ -226,6 +225,7 @@ protected boolean isProtectedPath(String target) {
226225
private Resource getResource(String pathInContext) {
227226
try {
228227
if (resourceBase != null) {
228+
pathInContext = URIUtil.encodePath(pathInContext);
229229
return resourceBase.resolve(pathInContext);
230230
}
231231
} catch (Exception ex) {

‎runtime/runtime_impl_jetty12/src/main/java/com/google/apphosting/runtime/jetty/ee8/ResourceFileServlet.java

+30-29
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,8 @@
3434
import org.eclipse.jetty.ee8.servlet.ServletContextHandler;
3535
import org.eclipse.jetty.ee8.servlet.ServletHandler;
3636
import org.eclipse.jetty.ee8.servlet.ServletMapping;
37+
import org.eclipse.jetty.server.AliasCheck;
38+
import org.eclipse.jetty.server.AllowedResourceAliasChecker;
3739
import org.eclipse.jetty.util.StringUtil;
3840
import org.eclipse.jetty.util.URIUtil;
3941
import org.eclipse.jetty.util.resource.Resource;
@@ -59,6 +61,7 @@ public class ResourceFileServlet extends HttpServlet {
5961
private Resource resourceBase;
6062
private String[] welcomeFiles;
6163
private FileSender fSender;
64+
private AliasCheck aliasCheck;
6265
ServletContextHandler chandler;
6366
ServletContext context;
6467
String defaultServletName;
@@ -90,6 +93,12 @@ public void init() throws ServletException {
9093
try {
9194
URL resourceBaseUrl = context.getResource("/" + appVersion.getPublicRoot());
9295
resourceBase = (resourceBaseUrl == null) ? null : ResourceFactory.of(chandler).newResource(resourceBaseUrl);
96+
if (resourceBase != null) {
97+
ContextHandler contextHandler = ContextHandler.getContextHandler(context);
98+
contextHandler.addAliasCheck(
99+
new AllowedResourceAliasChecker(contextHandler.getCoreContextHandler(), resourceBase));
100+
aliasCheck = contextHandler.getCoreContextHandler();
101+
}
93102
} catch (Exception ex) {
94103
throw new ServletException(ex);
95104
}
@@ -162,41 +171,32 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
162171
}
163172

164173
// Find the resource
165-
Resource resource = null;
166-
try {
167-
resource = getResource(pathInContext);
174+
Resource resource = getResource(pathInContext);
175+
if (resource == null) {
176+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
177+
return;
178+
}
168179

169-
if (resource == null) {
170-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
171-
return;
172-
}
180+
if (StringUtil.endsWithIgnoreCase(resource.getName(), ".jsp")) {
181+
// General paranoia: don't ever serve raw .jsp files.
182+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
183+
return;
184+
}
173185

174-
if (StringUtil.endsWithIgnoreCase(resource.getName(), ".jsp")) {
175-
// General paranoia: don't ever serve raw .jsp files.
176-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
177-
return;
186+
// Handle resource
187+
if (resource.isDirectory()) {
188+
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
189+
response.sendError(HttpServletResponse.SC_FORBIDDEN);
178190
}
179-
180-
// Handle resource
181-
if (resource.isDirectory()) {
182-
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
183-
response.sendError(HttpServletResponse.SC_FORBIDDEN);
184-
}
191+
} else {
192+
if (!resource.exists() || !aliasCheck.checkAlias(pathInContext, resource)) {
193+
logger.atWarning().log("Non existent resource: %s = %s", pathInContext, resource);
194+
response.sendError(HttpServletResponse.SC_NOT_FOUND);
185195
} else {
186-
if (resource == null || !resource.exists()) {
187-
logger.atWarning().log("Non existent resource: %s = %s", pathInContext, resource);
188-
response.sendError(HttpServletResponse.SC_NOT_FOUND);
189-
} else {
190-
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
191-
fSender.sendData(context, response, included, resource, request.getRequestURI());
192-
}
196+
if (included || !fSender.checkIfUnmodified(request, response, resource)) {
197+
fSender.sendData(context, response, included, resource, request.getRequestURI());
193198
}
194199
}
195-
} finally {
196-
if (resource != null) {
197-
// TODO: do we need to release.
198-
// resource.release();
199-
}
200200
}
201201
}
202202

@@ -226,6 +226,7 @@ protected boolean isProtectedPath(String target) {
226226
private Resource getResource(String pathInContext) {
227227
try {
228228
if (resourceBase != null) {
229+
pathInContext = URIUtil.encodePath(pathInContext);
229230
return resourceBase.resolve(pathInContext);
230231
}
231232
} catch (Exception ex) {

0 commit comments

Comments
 (0)