@Test public void shouldDisallowDirectoryTraversalsWithEncodedRequests() throws Exception { mkdir("/a/public"); writeFile("a/public/index.html", "hi"); mkdir("/a/private"); writeFile("a/private/index.html", "hi"); handler = new StaticFileHandler(new File(dir, "/a/public")); assertThat(handle(get("/index.html").build()), hasStatus(OK)); assertThat(handle(get("/%2e%2e%2fprivate/index.html").build()), hasStatus(NOT_FOUND)); }
@Override public Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context) { try { return resolveFile(request.path()) .map(ResolvedFile::new) .map(resolvedFile -> HttpResponse.response() .addHeader(CONTENT_TYPE, resolvedFile.mediaType) .body(resolvedFile.content, UTF_8) .build() .stream()) .map(Eventual::of) .orElseGet(() -> new HttpAggregator(NOT_FOUND_HANDLER).handle(request, context)); } catch (IOException e) { return Eventual.of(HttpResponse.response(INTERNAL_SERVER_ERROR).build().stream()); } }
StaticFileHandler implements HttpHandler { @Override public Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context) { try { return resolveFile(request.path()) .map(ResolvedFile::new) .map(resolvedFile -> HttpResponse.response() .addHeader(CONTENT_TYPE, resolvedFile.mediaType) .body(resolvedFile.content, UTF_8) .build() .stream()) .map(Eventual::of) .orElseGet(() -> new HttpAggregator(NOT_FOUND_HANDLER).handle(request, context)); } catch (IOException e) { return Eventual.of(HttpResponse.response(INTERNAL_SERVER_ERROR).build().stream()); } } }
StaticFileHandler implements HttpHandler { @Override public Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context) { try { return resolveFile(request.path()) .map(ResolvedFile::new) .map(resolvedFile -> HttpResponse.response() .addHeader(CONTENT_TYPE, resolvedFile.mediaType) .body(resolvedFile.content, UTF_8) .build() .stream()) .map(Eventual::of) .orElseGet(() -> new HttpAggregator(NOT_FOUND_HANDLER).handle(request, context)); } catch (IOException e) { return Eventual.of(HttpResponse.response(INTERNAL_SERVER_ERROR).build().stream()); } } StaticFileHandler(File dir); }
StaticFileHandler implements HttpHandler { @Override public Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context) { try { return resolveFile(request.path()) .map(ResolvedFile::new) .map(resolvedFile -> HttpResponse.response() .addHeader(CONTENT_TYPE, resolvedFile.mediaType) .body(resolvedFile.content, UTF_8) .build() .stream()) .map(Eventual::of) .orElseGet(() -> new HttpAggregator(NOT_FOUND_HANDLER).handle(request, context)); } catch (IOException e) { return Eventual.of(HttpResponse.response(INTERNAL_SERVER_ERROR).build().stream()); } } StaticFileHandler(File dir); @Override Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context); }
StaticFileHandler implements HttpHandler { @Override public Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context) { try { return resolveFile(request.path()) .map(ResolvedFile::new) .map(resolvedFile -> HttpResponse.response() .addHeader(CONTENT_TYPE, resolvedFile.mediaType) .body(resolvedFile.content, UTF_8) .build() .stream()) .map(Eventual::of) .orElseGet(() -> new HttpAggregator(NOT_FOUND_HANDLER).handle(request, context)); } catch (IOException e) { return Eventual.of(HttpResponse.response(INTERNAL_SERVER_ERROR).build().stream()); } } StaticFileHandler(File dir); @Override Eventual<LiveHttpResponse> handle(LiveHttpRequest request, HttpInterceptor.Context context);  }