ResourceHttpRequestHandler can expose the classes [SPR-8735]

[spring-projects-issues]

Amir Pashazadeh opened SPR-8735 and commented

I having something like

<mvc:resources mapping="/resources/**" location="classpath:/com/payeshgaran/framework"/>

a person can download a class file (or other forbidden files) within /com/payeshgaran/framework.

I think ResourceHttpRequestHandler needs to have properties to set rejected or allowed content types for it.

---

Affects: 3.0.6

[spring-projects-issues]

Rossen Stoyanchev commented

I think the idea is to have resources at a dedicated location (e.g. "classpath:/META-INF/public-web-resources/"). What do you serve from locations where classes reside?

[spring-projects-issues]

Rossen Stoyanchev commented

Resolving this as it hasn't been updated for a while and the recommended approach to serving classpath resources is to use a dedicated location.

[spring-projects-issues]

Amir Pashazadeh commented

I believe it is good to have .css, .js files just next to classes (for example tags) depend on them.