StaticFilesFilter implements RequestFilter { public boolean service(Request request, Response response, RequestHandler handler) throws IOException { String path = request.getPath(); if (path.equals("/favicon.ico")) return false; if (!path.contains(":")) { int dotx = path.lastIndexOf("."); if (dotx > 0) { URL url = context.getResource(path); if (url != null) { String suffix = path.substring(dotx + 1); if (suffix.equalsIgnoreCase(TapestryConstants.TEMPLATE_EXTENSION)) { response.sendError(HttpServletResponse.SC_FORBIDDEN, String.format("URI %s may not be accessed remotely.", path)); return true; } return false; } } } return handler.service(request, response); } StaticFilesFilter(Context context); boolean service(Request request, Response response, RequestHandler handler);  }
@Test public void request_for_favicon() throws IOException { Request request = newRequest("/favicon.ico"); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); replay(); RequestFilter filter = new StaticFilesFilter(context); assertFalse(filter.service(request, response, handler)); verify(); }
@Test public void path_does_not_contain_a_period() throws Exception { Request request = newRequest("/start"); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_service(handler, request, response, true); replay(); RequestFilter filter = new StaticFilesFilter(context); assertTrue(filter.service(request, response, handler)); verify(); }
@Test public void existing_file() throws Exception { URL url = new URL("file: String path = "/cell.gif"; Request request = newRequest(path); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_getResource(context, path, url); replay(); RequestFilter filter = new StaticFilesFilter(context); assertFalse(filter.service(request, response, handler)); verify(); }
@Test public void existing_template_file() throws Exception { URL url = new URL("file: String path = "/cell.tml"; Request request = newRequest(path); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_getResource(context, path, url); response.sendError( HttpServletResponse.SC_FORBIDDEN, "URI /cell.tml may not be accessed remotely."); replay(); RequestFilter filter = new StaticFilesFilter(context); assertTrue(filter.service(request, response, handler)); verify(); }
@Test public void existing_template_file_case_insenitive() throws Exception { URL url = new URL("file: String path = "/cell.TML"; Request request = newRequest(path); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_getResource(context, path, url); response.sendError( HttpServletResponse.SC_FORBIDDEN, "URI /cell.TML may not be accessed remotely."); replay(); RequestFilter filter = new StaticFilesFilter(context); assertTrue(filter.service(request, response, handler)); verify(); }
@Test public void not_a_static_file_request() throws Exception { String path = "/start.update"; Request request = newRequest(path); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_getResource(context, path, null); train_service(handler, request, response, true); replay(); RequestFilter filter = new StaticFilesFilter(context); assertTrue(filter.service(request, response, handler)); verify(); }
@Test public void colon_in_path_prevents_static_file_check() throws Exception { String path = "/start.update:anevent"; Request request = newRequest(path); Response response = mockResponse(); RequestHandler handler = mockRequestHandler(); Context context = mockContext(); train_service(handler, request, response, true); replay(); RequestFilter filter = new StaticFilesFilter(context); assertTrue(filter.service(request, response, handler)); verify(); }