Improve handling for invalid URLs

pom.xml

@@ -95,6 +95,18 @@
             <version>2.3</version>
             <scope>provided</scope>
         </dependency>
+        <dependency>
+            <groupId>junit</groupId>
+            <artifactId>junit</artifactId>
+            <version>4.12</version>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <version>1.9.0</version>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
 

src/main/java/org/webjars/servlet/WebjarsServlet.java

@@ -60,8 +60,19 @@ public void init() throws ServletException {
     protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String webjarsResourceURI = "/META-INF/resources" + request.getRequestURI().replaceFirst(request.getContextPath(), "");
         logger.log(Level.FINE, "Webjars resource requested: {0}", webjarsResourceURI);
-
-        String eTagName = this.getETagName(webjarsResourceURI);
+
+        if (isDirectoryRequest(webjarsResourceURI)) {
+            response.sendError(HttpServletResponse.SC_FORBIDDEN);
+            return;
+        }
+
+        String eTagName;
+        try {
+            eTagName = this.getETagName(webjarsResourceURI);
+        } catch (IllegalArgumentException e) {
+            response.sendError(HttpServletResponse.SC_NOT_FOUND);
+            return;
+        }
 
         if (!disableCache) {
             if (checkETagMatch(request, eTagName)
@@ -92,7 +103,11 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response) t
             response.sendError(HttpServletResponse.SC_NOT_FOUND);
         }
     }
-
+
+    private static boolean isDirectoryRequest(String uri) {
+        return uri.endsWith("/");
+    }
+
     /**
      *
      * @param webjarsResourceURI
@@ -108,10 +123,14 @@ private String getFileName(String webjarsResourceURI) {
      * 
      * @param webjarsResourceURI
      * @return
+     * @throws IllegalArgumentException when insufficient URI has given
      */
     private String getETagName(String webjarsResourceURI) {
 
     	String[] tokens = webjarsResourceURI.split("/");
+        if (tokens.length < 7) {
+            throw new IllegalArgumentException("insufficient URL has given: " + webjarsResourceURI);
+        }
         String version = tokens[5];
         String fileName = tokens[tokens.length - 1];
 

src/test/java/org/webjars/servlet/WebjarsServletTest.java

@@ -0,0 +1,75 @@
+package org.webjars.servlet;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.runners.MockitoJUnitRunner;
+
+import javax.servlet.ServletConfig;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.anyInt;
+import static org.mockito.Mockito.atLeastOnce;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+@RunWith(MockitoJUnitRunner.class)
+public class WebjarsServletTest {
+
+    private static final String ANY_CONTEXT_PATH = "/app";
+    @Mock
+    private HttpServletRequest request;
+    @Mock
+    private HttpServletResponse response;
+    @Mock
+    private ServletContext servletContext;
+    @Mock
+    private ServletConfig servletConfig;
+    @Mock
+    private ServletOutputStream servletOutputStream;
+    @Spy
+    private WebjarsServlet sut;
+
+    @Before
+    public void setUp() throws Exception {
+        when(request.getContextPath()).thenReturn(ANY_CONTEXT_PATH);
+        when(sut.getServletConfig()).thenReturn(servletConfig);
+        when(sut.getServletContext()).thenReturn(servletContext);
+        when(response.getOutputStream()).thenReturn(servletOutputStream);
+    }
+
+    @Test
+    public void shouldWriteContentForFileAvailable() throws Exception {
+        when(request.getRequestURI()).thenReturn(ANY_CONTEXT_PATH + "/webjars/foo/1.0/bar.js");
+        when(servletContext.getMimeType("bar.js")).thenReturn("application/javascript");
+
+        sut.doGet(request, response);
+
+        verify(servletOutputStream, atLeastOnce()).write(any(byte[].class), anyInt(), anyInt());
+        verify(response).setHeader("ETag", "bar.js_1.0");
+    }
+
+    @Test
+    public void shouldSendForbiddenForDirectoryRequest() throws Exception {
+        when(request.getRequestURI()).thenReturn(ANY_CONTEXT_PATH + "/webjars/foo/1.0/");
+
+        sut.doGet(request, response);
+
+        verify(response).sendError(HttpServletResponse.SC_FORBIDDEN);
+    }
+
+    @Test
+    public void shouldSendNotFoundForInsufficientFileRequest() throws Exception {
+        when(request.getRequestURI()).thenReturn(ANY_CONTEXT_PATH + "/foo/bar.js");
+
+        sut.doGet(request, response);
+
+        verify(response).sendError(HttpServletResponse.SC_NOT_FOUND);
+    }
+}

src/test/resources/META-INF/resources/webjars/foo/1.0/bar.js

@@ -0,0 +1 @@
+// meaningless file - just exists for test