Skip to content

Commit

Permalink
removes ability to auto-include local resources via URI, if a URI is …
Browse files Browse the repository at this point in the history
…detected as local, we'll try to see if the file exist on the file system and load it directly instead of by request which is how we'll manage auto-including local URIs.
  • Loading branch information
Shazwazza committed Feb 2, 2015
1 parent d12408d commit 6a9e22d
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 15 deletions.
Expand Up @@ -136,6 +136,27 @@ public CompositeFileDefinition WritePathToStream(ClientDependencyType type, stri
|| ex is HttpException)
{
//could not parse the string into a fileinfo or couldn't mappath, so we assume it is a URI

//before we try to load it by URI, we want to check if the URI is a local request, we'll try to detect if it is and
// then try to load it from the file system, if the file isn't there then we'll continue trying to load it via the URI.
Uri uri;
if (Uri.TryCreate(path, UriKind.RelativeOrAbsolute, out uri) && uri.IsLocalUri(context))
{
var localPath = uri.PathAndQuery;
var fi = new FileInfo(context.Server.MapPath(localPath));
if (fi.Exists)
{
try
{
WriteFileToStream(sw, fi, type, path, context); //internal request
}
catch (Exception ex1)
{
ClientDependencySettings.Instance.Logger.Error(string.Format("Could not load file contents from {0}. EXCEPTION: {1}", path, ex1.Message), ex1);
}
}
}

def = WriteFileToStream(sw, path, type, context);
}
else
Expand Down
22 changes: 7 additions & 15 deletions ClientDependency.Core/RequestHelper.cs
Expand Up @@ -88,24 +88,16 @@ internal class RequestHelper
//if this isn't a web resource, we need to check if its approved
if (!bundleExternalUri)
{
//first, we will just allow local requests
if (uri.IsLocalUri(http))
// get the domain to test, with starting dot and trailing port, then compare with
// declared (authorized) domains. the starting dot is here to allow for subdomain
// approval, eg '.maps.google.com:80' will be approved by rule '.google.com:80', yet
// '.roguegoogle.com:80' will not.
var domain = string.Format(".{0}:{1}", uri.Host, uri.Port);

if (approvedDomains.Any(bundleDomain => domain.EndsWith(bundleDomain)))
{
bundleExternalUri = true;
}
else
{
// get the domain to test, with starting dot and trailing port, then compare with
// declared (authorized) domains. the starting dot is here to allow for subdomain
// approval, eg '.maps.google.com:80' will be approved by rule '.google.com:80', yet
// '.roguegoogle.com:80' will not.
var domain = string.Format(".{0}:{1}", uri.Host, uri.Port);

if (approvedDomains.Any(bundleDomain => domain.EndsWith(bundleDomain)))
{
bundleExternalUri = true;
}
}
}

if (bundleExternalUri)
Expand Down

0 comments on commit 6a9e22d

Please sign in to comment.