Uploaded image for project: 'Tapestry 5'
  1. Tapestry 5
  2. TAP5-1779

Tapestry allows directory listing of assets via client browser

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 5.3.1, 5.3, 5.4
    • Fix Version/s: 5.4
    • Component/s: tapestry-core
    • Labels:
      None

      Description

      You can access asset directory listing by going to Tapestry web site http://.../assets/

      {version}

      /ctx/
      This should be disallowed.

      Here is a Nabble discussion about this: http://tapestry.1045711.n5.nabble.com/T5-3-do-we-still-need-AssetProtectionDispatcher-td5055048.html

      I have a fix for this in the flowlogix tapestry library:
      http://code.google.com/p/flowlogix/source/browse/tapestry-services/src/main/java/com/flowlogix/web/services/SecurityModule.java#70

      --------------------------- fix for the code ----------------
      /**

      • See <a href="https://issues.apache.org/jira/browse/TAP5-1779" target="_blank">TAP5-1779</a>
        */
        @Contribute(RequestHandler.class)
        public void disableAssetDirListing(OrderedConfiguration<RequestFilter> configuration,
        @Symbol(SymbolConstants.APPLICATION_VERSION) final String applicationVersion,
        final Context ctxt)
        {
        configuration.add("DisableDirListing", new RequestFilter() {
        @Override
        public boolean service(Request request, Response response, RequestHandler handler) throws IOException
        {
        final String assetFolder = assetPathPrefix + applicationVersion + "/"
        + RequestConstants.CONTEXT_FOLDER;
        if (request.getPath().startsWith(assetFolder))
        Unknown macro: { if(request.getPath().endsWith("/") || ctxt.getRealFile(pathProcessor.removeAssetPathPart( request.getPath())).isDirectory()) { return false; } }

        return handler.service(request, response);
        }
        }, "before:AssetDispatcher");
        }

        Attachments

          Activity

            People

            • Assignee:
              hlship Howard M. Lewis Ship
              Reporter:
              lprimak Lenny Primak
            • Votes:
              1 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: