@Test void includeEventWhenIllegalPath() { assertNull(this.handler.includeEvent(null, "../WEB-INF/xwiki.cfg", "xwiki:Main.WebHome", "parse"), "Template shouldn't have been returned"); assertEquals(1, this.logCapture.size()); assertEquals("Direct access to template file [/WEB-INF/xwiki.cfg] refused. Possible break-in attempt!", this.logCapture.getMessage(0)); }
@Override public String includeEvent(Context context, String includeResourcePath, String currentResourcePath, String directiveName) { LOGGER.trace("Velocity include event: include [{}] from [{}] using [{}]", includeResourcePath, currentResourcePath, directiveName); String template = URI.create(BASE_TEMPLATE_DIRECTORY + includeResourcePath).normalize().toString(); if (!template.startsWith(BASE_TEMPLATE_DIRECTORY)) { LOGGER.warn("Direct access to template file [{}] refused. Possible break-in attempt!", template); return null; } return template; }
RestrictParseLocationEventHandler implements IncludeEventHandler { @Override public String includeEvent(Context context, String includeResourcePath, String currentResourcePath, String directiveName) { LOGGER.trace("Velocity include event: include [{}] from [{}] using [{}]", includeResourcePath, currentResourcePath, directiveName); String template = URI.create(BASE_TEMPLATE_DIRECTORY + includeResourcePath).normalize().toString(); if (!template.startsWith(BASE_TEMPLATE_DIRECTORY)) { LOGGER.warn("Direct access to template file [{}] refused. Possible break-in attempt!", template); return null; } return template; } }
RestrictParseLocationEventHandler implements IncludeEventHandler { @Override public String includeEvent(Context context, String includeResourcePath, String currentResourcePath, String directiveName) { LOGGER.trace("Velocity include event: include [{}] from [{}] using [{}]", includeResourcePath, currentResourcePath, directiveName); String template = URI.create(BASE_TEMPLATE_DIRECTORY + includeResourcePath).normalize().toString(); if (!template.startsWith(BASE_TEMPLATE_DIRECTORY)) { LOGGER.warn("Direct access to template file [{}] refused. Possible break-in attempt!", template); return null; } return template; }  }
RestrictParseLocationEventHandler implements IncludeEventHandler { @Override public String includeEvent(Context context, String includeResourcePath, String currentResourcePath, String directiveName) { LOGGER.trace("Velocity include event: include [{}] from [{}] using [{}]", includeResourcePath, currentResourcePath, directiveName); String template = URI.create(BASE_TEMPLATE_DIRECTORY + includeResourcePath).normalize().toString(); if (!template.startsWith(BASE_TEMPLATE_DIRECTORY)) { LOGGER.warn("Direct access to template file [{}] refused. Possible break-in attempt!", template); return null; } return template; }  @Override String includeEvent(Context context, String includeResourcePath, String currentResourcePath,
        String directiveName); }
RestrictParseLocationEventHandler implements IncludeEventHandler { @Override public String includeEvent(Context context, String includeResourcePath, String currentResourcePath, String directiveName) { LOGGER.trace("Velocity include event: include [{}] from [{}] using [{}]", includeResourcePath, currentResourcePath, directiveName); String template = URI.create(BASE_TEMPLATE_DIRECTORY + includeResourcePath).normalize().toString(); if (!template.startsWith(BASE_TEMPLATE_DIRECTORY)) { LOGGER.warn("Direct access to template file [{}] refused. Possible break-in attempt!", template); return null; } return template; }  @Override String includeEvent(Context context, String includeResourcePath, String currentResourcePath,
        String directiveName);  }