[TAP5-1779] Tapestry allows directory listing of assets via client browser

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 5.3.1, 5.3, 5.4
• Fix Version/s: 5.4
• Component/s: tapestry-core
• Assignee: Howard Lewis Ship
• Reporter: Lenny Primak
• Created: 07/Dec/11 21:29
• Updated: 25/Jul/13 00:00
• Resolved: 25/Jul/13 00:00

Description

You can access asset directory listing by going to Tapestry web site http://.../assets/

{version}

/ctx/
This should be disallowed.

Here is a Nabble discussion about this: http://tapestry.1045711.n5.nabble.com/T5-3-do-we-still-need-AssetProtectionDispatcher-td5055048.html

I have a fix for this in the flowlogix tapestry library:
http://code.google.com/p/flowlogix/source/browse/tapestry-services/src/main/java/com/flowlogix/web/services/SecurityModule.java#70

--------------------------- fix for the code ----------------
/**

• See <a href="https://issues.apache.org/jira/browse/TAP5-1779" target="_blank">TAP5-1779</a>
  */
  @Contribute(RequestHandler.class)
  public void disableAssetDirListing(OrderedConfiguration<RequestFilter> configuration,
  @Symbol(SymbolConstants.APPLICATION_VERSION) final String applicationVersion,
  final Context ctxt)
  {
  configuration.add("DisableDirListing", new RequestFilter() {
  @Override
  public boolean service(Request request, Response response, RequestHandler handler) throws IOException
  {
  final String assetFolder = assetPathPrefix + applicationVersion + "/"
  + RequestConstants.CONTEXT_FOLDER;
  if (request.getPath().startsWith(assetFolder))
  Unknown macro: { if(request.getPath().endsWith("/") || ctxt.getRealFile(pathProcessor.removeAssetPathPart( request.getPath())).isDirectory()) { return false; } }

  return handler.service(request, response);
  }
  }, "before:AssetDispatcher");
  }