StaticResourceClassloader extends ClassLoader { @Override public URL getResource(String path) { if (overrideIsSane()) { String fspath = path.replaceAll("../", ""); fspath = fspath.replace(bundlePathPrefix, ""); File file = new File(overrideDir.getAbsoluteFile() + File.separator + fspath); if (file.exists() && file.isFile()) { try { logger.debug("Resource from filesystem overrides bundle resource: {}", file.getAbsolutePath()); return file.toURI().toURL(); } catch (MalformedURLException e) { logger.error("Failed to get filesystem URL for override file! ", e); } } } URL out = bundle.getResource(path); logger.debug("Serving resource from bundle: {}", out); return out; } StaticResourceClassloader(Bundle bundle, File overrideDir, String bundleResourcePath); @Override URL getResource(String path); boolean overrideIsSane();  }
@Test public void testBundleResourceLoading() throws Exception { StaticResourceClassloader klas = new StaticResourceClassloader(new MockBundle(), overrideDir, bundlePath); URL result = klas.getResource(genuineBundleResource); Assert.assertNotNull(result); Assert.assertEquals(new URL(genuineResourceURL), result); }
@Test public void testFielesystemResourceOverriding() throws Exception { StaticResourceClassloader klas = new StaticResourceClassloader(new MockBundle(), overrideDir, bundlePath); URL result = klas.getResource(overriddenBundleResource); Assert.assertNotNull(result); Assert.assertEquals(overrideResource.toURI().toURL(), result); }
@Test public void testMaliciousPath() { StaticResourceClassloader klas = new StaticResourceClassloader(new MockBundle(), overrideDir, bundlePath); URL result = klas.getResource("/etc/hostname"); Assert.assertNull(result); result = klas.getResource("../../etc/hostname"); Assert.assertNull(result); }