Schema files accessible via URL in FusionAuth

[lyleschemmerling]

Schema files accessible via URL in FusionAuth

Description

Files accessible in the class path can be resolved via URL.

This is the intended design of the MVC. No known security risks exist. But we should revisit how the MVC performs static file resolution and consider modifying it to avoid confusion.

These files are shipped anyway and publicly available.

Observed in version

1.47.0

Affects versions

TBD

Internal

• https://inversoft.slack.com/archives/C051S8N8E/p1694468128323879?thread_ts=1694463294.678289&cid=C051S8N8E

Community guidelines

All issues filed in this repository must abide by the FusionAuth community guidelines.

Release Notes

Update the FusionAuth static file resolution configuration to further limit class path resolution. While no known security risks exist with the current behavior, it is not necessary.

[robotdan]

Internal:

• Add static resource filters to allow each request to optionally reject based upon the URI prime-framework/prime-mvc#35
• https://github.com/FusionAuth/fusionauth-app/commit/f086d98b3f89f58d4b0ad1a435a3cde260ae6a72