Skip to content

Commit 16a4951

Browse files
committed
resources - provided extension point on ResourcesRoute constructor allowing to override behaviour forbidding usage of / baseResourcePath, in case someone would like to
serve resources from root classpath, even if this is not advised from a security standpoint
1 parent 9effdfd commit 16a4951

File tree

1 file changed

+14
-5
lines changed

1 file changed

+14
-5
lines changed

restx-core/src/main/java/restx/ResourcesRoute.java

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -91,15 +91,24 @@ public ResourcesRoute(String name, String baseRestPath, String baseResourcePath,
9191
public ResourcesRoute(String name, String baseRestPath, String baseResourcePath, ImmutableMap<String, String> aliases, List<CachedResourcePolicy> cachedResourcePolicies) {
9292
this.name = checkNotNull(name);
9393
this.baseRestPath = ("/" + checkNotNull(baseRestPath) + "/").replaceAll("/+", "/");
94-
this.baseResourcePath = checkNotNull(baseResourcePath)
95-
.replace('.', '/').replaceAll("^/", "").replaceAll("/$", "") + "/";
96-
if("/".equals(this.baseResourcePath)){
97-
throw new IllegalArgumentException("Please, avoid using '/' as ResourcesRoute's baseResourcePath as it represents serious security flaws (people will be able to read your classpath configuration files)");
98-
}
94+
this.baseResourcePath = this.ensureBaseResourcePathValid(baseResourcePath);
9995
this.aliases = checkNotNull(aliases);
10096
this.cachedResourcePolicies = ImmutableList.copyOf(cachedResourcePolicies);
10197
}
10298

99+
protected String ensureBaseResourcePathValid(String baseResourcePath) {
100+
String escapedBaseResourcePath = checkNotNull(baseResourcePath)
101+
.replace('.', '/')
102+
.replaceAll("^/", "")
103+
.replaceAll("/$", "") + "/";
104+
105+
if("/".equals(escapedBaseResourcePath)){
106+
throw new IllegalArgumentException("Please, avoid using '/' as ResourcesRoute's baseResourcePath as it represents serious security flaws (people will be able to read your classpath configuration files)");
107+
}
108+
109+
return escapedBaseResourcePath;
110+
}
111+
103112
@Override
104113
public Optional<RestxHandlerMatch> match(RestxRequest req) {
105114
if (req.getHttpMethod().equals("GET") && req.getRestxPath().startsWith(baseRestPath)) {

0 commit comments

Comments
 (0)