Strip only allowed extensions!

oblac · Jun 17, 2018 · 4b15af3 · 4b15af3
1 parent acbec82
commit 4b15af3
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 13 deletions.
diff --git a/jodd-core/src/main/java/jodd/net/MimeTypes.java b/jodd-core/src/main/java/jodd/net/MimeTypes.java
@@ -60,9 +60,9 @@ public class MimeTypes {
 	private static final HashMap<String, String> MIME_TYPE_MAP;	// extension -> mime-type map
 
 	static {
-		Properties mimes = new Properties();
+		final Properties mimes = new Properties();
 
-		InputStream is = MimeTypes.class.getResourceAsStream(MimeTypes.class.getSimpleName() + ".properties");
+		final InputStream is = MimeTypes.class.getResourceAsStream(MimeTypes.class.getSimpleName() + ".properties");
 		if (is == null) {
 			throw new IllegalStateException("Mime types file missing");
 		}
@@ -78,10 +78,10 @@ public class MimeTypes {
 
 		MIME_TYPE_MAP = new HashMap<>(mimes.size() * 2);
 
-		Enumeration keys = mimes.propertyNames();
+		final Enumeration keys = mimes.propertyNames();
 		while (keys.hasMoreElements()) {
 			String mimeType = (String) keys.nextElement();
-			String extensions = mimes.getProperty(mimeType);
+			final String extensions = mimes.getProperty(mimeType);
 
 			if (mimeType.startsWith("/")) {
 				mimeType = "application" + mimeType;
@@ -95,9 +95,9 @@ public class MimeTypes {
 				mimeType = "video" + mimeType.substring(1);
 			}
 
-			String[] allExtensions = StringUtil.splitc(extensions, ' ');
+			final String[] allExtensions = StringUtil.splitc(extensions, ' ');
 
-			for (String extension : allExtensions) {
+			for (final String extension : allExtensions) {
 				if (MIME_TYPE_MAP.put(extension, mimeType) != null) {
 					throw new IllegalArgumentException("Duplicated extension: " + extension);
 				}
@@ -138,16 +138,16 @@ public static String lookupMimeType(final String ext) {
 	 * @param useWildcard if set, mime types are wildcard patterns
 	 */
 	public static String[] findExtensionsByMimeTypes(String mimeType, final boolean useWildcard) {
-		ArrayList<String> extensions = new ArrayList<>();
+		final ArrayList<String> extensions = new ArrayList<>();
 
 		mimeType = mimeType.toLowerCase();
-		String[] mimeTypes = StringUtil.splitc(mimeType, ", ");
+		final String[] mimeTypes = StringUtil.splitc(mimeType, ", ");
 
-		for (Map.Entry<String, String> entry : MIME_TYPE_MAP.entrySet()) {
-			String entryExtension = entry.getKey();
-			String entryMimeType = entry.getValue().toLowerCase();
+		for (final Map.Entry<String, String> entry : MIME_TYPE_MAP.entrySet()) {
+			final String entryExtension = entry.getKey();
+			final String entryMimeType = entry.getValue().toLowerCase();
 
-			int matchResult = useWildcard ?
+			final int matchResult = useWildcard ?
 					Wildcard.matchOne(entryMimeType, mimeTypes) :
 					StringUtil.equalsOne(entryMimeType, mimeTypes);
 
@@ -162,4 +162,11 @@ public static String[] findExtensionsByMimeTypes(String mimeType, final boolean
 
 		return extensions.toArray(new String[0]);
 	}
+
+	/**
+	 * Returns {@code true} if given value is one of the registered MIME extensions.
+	 */
+	public static boolean isRegisteredExtension(final String extension) {
+		return MIME_TYPE_MAP.containsKey(extension);
+	}
 }
diff --git a/jodd-madvoc/src/main/java/jodd/madvoc/component/ActionsManagerCfg.java b/jodd-madvoc/src/main/java/jodd/madvoc/component/ActionsManagerCfg.java
@@ -38,6 +38,7 @@ abstract class ActionsManagerCfg {
 	protected Class<? extends PathMacros> pathMacroClass;
 	protected String[] pathMacroSeparators;
 	protected boolean strictRoutePaths;
+	protected String[] pathExtensionsToStrip = new String[]{"htm", "html"};
 
 	public ActionsManagerCfg() {
 		this.detectDuplicatePathsEnabled = true;
@@ -89,4 +90,12 @@ public boolean isStrictRoutePaths() {
 	public void setStrictRoutePaths(final boolean strictRoutePaths) {
 		this.strictRoutePaths = strictRoutePaths;
 	}
+
+	public String[] getPathExtensionsToStrip() {
+		return pathExtensionsToStrip;
+	}
+
+	public void setPathExtensionsToStrip(final String... pathExtensionsToStrip) {
+		this.pathExtensionsToStrip = pathExtensionsToStrip;
+	}
 }
diff --git a/jodd-madvoc/src/main/java/jodd/madvoc/config/Routes.java b/jodd-madvoc/src/main/java/jodd/madvoc/config/Routes.java
@@ -83,12 +83,19 @@ public ActionRuntime lookup(final String method, final String[] pathChunks) {
 			if (actionsManager.isStrictRoutePaths()) {
 				return null;
 			}
-			// special
+
+			// special case
 			final String lastPath = pathChunks[pathChunks.length - 1];
 			final int lastNdx = lastPath.lastIndexOf('.');
 			if (lastNdx == -1) {
 				return null;
 			}
+			final String pathExtension = lastPath.substring(lastNdx + 1);
+
+			if (StringUtil.equalsOne(pathExtension, actionsManager.getPathExtensionsToStrip()) == -1) {
+				return null;
+			}
+
 			pathChunks[pathChunks.length - 1] = lastPath.substring(0, lastNdx);
 		}
 	}