New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
FileService: Querying /file.png/anything where /file.png is a file throws #4654
FileService: Querying /file.png/anything where /file.png is a file throws #4654
Conversation
727e873
to
01d8439
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Eek. Nice find.
This could be a separate PR, but I wonder whether we have the same issue in WebJar and Resource service.
@@ -86,13 +85,14 @@ object FileService { | |||
case _ => OptionT.none | |||
} | |||
resolvedPath | |||
.semiflatMap(path => F.delay(path.toRealPath(LinkOption.NOFOLLOW_LINKS))) | |||
.flatMapF(path => | |||
F.delay(if (Files.exists(path)) Some(path.toRealPath(LinkOption.NOFOLLOW_LINKS)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we add the same LinkOption to the exists
call to make it consistent with the toRealPath
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Done - thank you for pointing it out.
Exception is `java.nio.file.FileSystemException: Not a directory`. Found bot queries in Scala Algorithms logs that are leading to an HTTP 5xx error. To avoid this, we explicitly check if what we are querying is a file, before attempting to resolve the real path; the exception is currently raised in particular where `.toRealPath` is called. Alternative approach would be to capture the `FileSystemException` as well, but it could hide other errors like `AccessDeniedException`. Because we already do a check, the check for `NoSuchFileException` becomes redundant.
01d8439
to
8e46331
Compare
I still think this is potentially an issue in the two related services, but this is good on its own. |
Exception is
java.nio.file.FileSystemException: Not a directory
.Found bot queries in Scala Algorithms logs that are leading to an HTTP 5xx error.
To avoid this, we explicitly check if what we are querying is a file, before attempting to resolve the real path; the exception is currently raised in particular where
.toRealPath
is called.Alternative approach would be to capture the
FileSystemException
as well, but it could hide other errors likeAccessDeniedException
. Because we already do a check, the check forNoSuchFileException
becomes redundant.Before changing main code:
