Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

StaticFileServer dumps file listing when directory is accessed and application is running in (at least) Tomcat #11047

Closed
fluorumlabs opened this issue May 21, 2021 · 12 comments · Fixed by Hack23/cia#3115
Closed

StaticFileServer dumps file listing when directory is accessed and application is running in (at least) Tomcat #11047

fluorumlabs opened this issue May 21, 2021 · 12 comments · Fixed by Hack23/cia#3115
Assignees
@caalador
Labels
bug Impact: High Severity: Major spring
Projects
OLD Vaadin Flow bugs & maintenance (V...

Comments

@fluorumlabs
Copy link
Contributor

Steps to reproduce:

Development mode:

  1. Create SVC project
  2. Run it
  3. Open http://localhost:8080/frontend/.; in browser
  4. Observe list of files

Production mode:

  1. Open https://start.vaadin.com/frontend/.; in browser
  2. Observe list of files
@miguelatvaadin miguelatvaadin added this to Needs triage in OLD Vaadin Flow bugs & maintenance (Vaadin 10+) via automation May 24, 2021
@miguelatvaadin
Copy link
Contributor

Hi @fluorumlabs ,

coudl you please provide versions?

Thanks

@fluorumlabs
Copy link
Contributor Author

fluorumlabs commented May 24, 2021 •
edited

At least both LTS and v19 are affected. Since StaticFileServer hasn't changed much, I assume that all versions starting with V10 are affected

@miguelatvaadin
Copy link
Contributor

ok. Thanks, @fluorumlabs

@caalador
Copy link
Contributor

I couldn't replicate this running skeleton-starter-flow, but it does happen with the spring-boot based starter skeleton-starter-flow-spring

@fluorumlabs
Copy link
Contributor Author

As far as I remember, skeleton-starter-flow use jetty

@caalador
Copy link
Contributor

caalador commented May 25, 2021 •
edited

Deploying the skeleton-starter-flow war to tomcat 9.0.39 I only get the result Could not navigate to 'frontend/.;'
Also a quick debug run on skeleton-starter-flow-spring notes that the request to frontend/.; never comes to StaticFileServer::isStaticResourceRequest but is served from somewhere else.

@fluorumlabs
Copy link
Contributor Author

Same behavior can be observed with /VAADIN/static/.;

Not sure how labs.vaadin.com is configured, but probing two apps there works just "fine":
https://labs.vaadin.com/edit-multiple/.;, https://labs.vaadin.com/theme-example/.;

@caalador
Copy link
Contributor

That is the same it can only be done on a spring-boot project as far as I can find.
You can even start from start.vaadin.com/.; and continue from there with adding folders that you see.

@fluorumlabs
Copy link
Contributor Author

Seems it is Spring boot specific. However, my observations/debugging shown that the actual file list is served by StaticFileServer. In fact, this is the default behavior of FileInputStream when File points to a directory

@caalador
Copy link
Contributor

Would seem so. Getting a Spring project to break on break points seems like a game of luck at times.
In the spring-skeleton request.getPathInfo() returns /. for /.; and we only check for endsWith("/") to determine a directory

@fluorumlabs
Copy link
Contributor Author

getPathInfo() simply strips path parameters in Tomcat (the ones starting with ;), I add ; simply to prevent web browser from normalizing URL. The same effect can be achieved with curl https://labs.vaadin.com/edit-multiple/. --path-as-is

@fluorumlabs
Copy link
Contributor Author

Regarding checking if path points to a directory or not -- all these URLs point to the same directory:

  • https://labs.vaadin.com/edit-multiple/frontend/.
  • https://labs.vaadin.com/edit-multiple/frontend/form/..
  • https://labs.vaadin.com/edit-multiple/frontend

The point is: just testing for . or .. is not enough (even though it will prevent from listing the root)

caalador added a commit that referenced this issue May 25, 2021
@caalador
fix: don't serve directories as static files
7098c86 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
@caalador caalador mentioned this issue May 25, 2021
Merged
@caalador caalador self-assigned this May 25, 2021
caalador added a commit that referenced this issue May 28, 2021
@caalador
fix: don't serve directories as static files (#11072)
7bf140b 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
vaadin-bot pushed a commit that referenced this issue May 28, 2021
@caalador @vaadin-bot
fix: don't serve directories as static files (#11072)
f1f21e9 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
vaadin-bot pushed a commit that referenced this issue May 28, 2021
@caalador @vaadin-bot
fix: don't serve directories as static files (#11072)
6c89198 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
caalador added a commit that referenced this issue May 28, 2021
@caalador
fix: don't serve directories as static files (#11072)
bf6cad2 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
# Conflicts:
#	flow-server/src/main/java/com/vaadin/flow/server/StaticFileServer.java
@caalador caalador mentioned this issue May 28, 2021
Merged
caalador added a commit that referenced this issue May 28, 2021
@caalador
fix: don't serve directories as static files (#11072)
6940b0f 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
# Conflicts:
#	flow-server/src/main/java/com/vaadin/flow/server/StaticFileServer.java
@denis-anisimov denis-anisimov mentioned this issue May 28, 2021
Closed
vaadin-bot added a commit that referenced this issue May 28, 2021
@vaadin-bot @caalador
fix: don't serve directories as static files (#11072) (#11104)
48174a9 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047

Co-authored-by: caalador <mikael.grankvist@vaadin.com>
vaadin-bot added a commit that referenced this issue May 28, 2021
@vaadin-bot @caalador
fix: don't serve directories as static files (#11072) (#11103)
1a06a41 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047

Co-authored-by: caalador <mikael.grankvist@vaadin.com>
denis-anisimov pushed a commit that referenced this issue Jun 1, 2021
@caalador
fix: don't serve directories as static files (#11072)
902a602 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
# Conflicts:
#	flow-server/src/main/java/com/vaadin/flow/server/StaticFileServer.java
vaadin-bot pushed a commit that referenced this issue Jun 1, 2021
@caalador @vaadin-bot
fix: don't serve directories as static files (#11072)
56c154b 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
# Conflicts:
#	flow-server/src/main/java/com/vaadin/flow/server/StaticFileServer.java
vaadin-bot added a commit that referenced this issue Jun 1, 2021
@vaadin-bot @caalador
fix: don't serve directories as static files (#11072) (#11122)
1e29057 
Add check to the resource to see
if it is a directory and do not serve
if this is the case.

Fixe #11047
# Conflicts:
#	flow-server/src/main/java/com/vaadin/flow/server/StaticFileServer.java

Co-authored-by: caalador <mikael.grankvist@vaadin.com>
OLD Vaadin Flow bugs & maintenance (Vaadin 10+) automation moved this from WIP to Closed Jun 28, 2021
@renovate renovate bot mentioned this issue Jul 7, 2021
Merged
1 task
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@caalador caalador

Labels
bug Impact: High Severity: Major spring
Projects
OLD Vaadin Flow bugs & maintenance (V...
Closed
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update cia.project.versions.vaadin to v8.13.2 Hack23/cia
3 participants
@caalador @fluorumlabs @miguelatvaadin