Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Auto add AliasChecker for custom Base Resource in DefaultServlet #11492

Open
joakime opened this issue Mar 7, 2024 · 0 comments
Open

Auto add AliasChecker for custom Base Resource in DefaultServlet #11492

joakime opened this issue Mar 7, 2024 · 0 comments
Assignees

Comments

@joakime
Copy link
Contributor

joakime commented Mar 7, 2024

Jetty version(s)
Jetty 12.0.7

Enhancement Description
If a user adds a DefaultServlet with a custom Base Resource, like this ...

ServletHolder holder = new ServletHolder("ui", new DefaultServlet());
servletContextHandler.addServlet(holder, "/ui/*");
URL url = getStaticContentURL("/ui/");
holder.setInitParameter("baseResource", url.toExternalForm());

Then this base resource cannot serve content as the AliasCheck that come from the existing ServletContextHandler are not aware of this new Base Resource.

Now a user will have to add an additional AliasCheck for this new Base Resource.

Resource base = servletContextHandler.newResource(url);
servletContextHandler.addAliasCheck(new AllowedResourceAliasChecker(servletContextHandler, base));

This is particularly difficult to do when using dynamic servlet registration techniques, or with the servlet descriptor (WEB-INF/web.xml)

ServletRegistration sr = servletContext.addServlet("ui", defaultServlet);
sr.addMapping("/ui/*");
URL url = getStaticContentURL("/ui/");
sr.setInitParameter("baseResource", url.toExternalForm());

I propose that the DefaultServlet itself auto-add the AllowedResourceAliasChecker for any custom Base Resource that it is told to use.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: No status
Development

No branches or pull requests

2 participants