package mesosphere.marathon
package api

import org.eclipse.jetty.servlet.DefaultServlet
import org.eclipse.jetty.util.resource.Resource

class PublicServlet extends DefaultServlet {

  private[this] val path = "public"
  private[this] val pathWithSlash = s"^/$path/"

  // Set resource base to serve resources from classpath available under /public/*.
  override def getInitParameter(name: String): String = name match {
    case "resourceBase" => Option(getClass.getClassLoader.getResource(path)).fold(null: String)(_.toExternalForm)
    case _ => super.getInitParameter(name)
  }

  // The resource requested is /public/{path}
  // Since the resource base already is public, we strip public from the path
  @SuppressWarnings(Array("all"))
  override def getResource(pathInContext: String): Resource = {
    super.getResource(pathInContext.replaceFirst(pathWithSlash, ""))
  }
}


package mesosphere.marathon
package api

import org.eclipse.jetty.servlet.DefaultServlet
import org.eclipse.jetty.util.resource.Resource

class PublicServlet extends DefaultServlet {

  private[this] val path = "public"
  private[this] val pathWithSlash = s"^/$path/"

  // Set resource base to serve resources from classpath available under /public/*.
  override def getInitParameter(name: String): String = name match {
    case "resourceBase" => Option(getClass.getClassLoader.getResource(path)).fold(null: String)(_.toExternalForm)
    case "dirAllowed" => "false"
    case _ => super.getInitParameter(name)
  }

  // The resource requested is /public/{path}
  // Since the resource base already is public, we strip public from the path
  @SuppressWarnings(Array("all"))
  override def getResource(pathInContext: String): Resource = {
    super.getResource(pathInContext.replaceFirst(pathWithSlash, ""))
  }
}


Disable directory listing under /public.
Disable directory listing under /public.

Summary:
The jetty DefaultServlet has directory listing enabled by default.
Even if this only allows access to public documentation, we should disable this.

Test Plan:
Start Marathon and access :8080/public/api/
This should result in an HTTP/1.1 403 Forbidden

Reviewers: meichstedt, unterstein, jenkins

Reviewed By: meichstedt, unterstein, jenkins

Subscribers: marathon-dev

JIRA Issues: DCOS-14539

Differential Revision: https://phabricator.mesosphere.com/D682
