Skip to content

Commit dd6d5d7

Browse files
ComLockComLock
committed
Fix #29 Service accepts excess slashes
1 parent 17c87d3 commit dd6d5d7

File tree

4 files changed

+126
-31
lines changed

4 files changed

+126
-31
lines changed

‎src/bun/features/assetService.feature‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ Feature: asset service
22

33
Background: State is reset before each test
44
Given the request is reset
5+
Given loglevel is set to "silent"
56

67
Scenario: Responds with 200 ok when resource found
78
Given enonic is running in production mode
@@ -33,6 +34,126 @@ Scenario: Responds with 200 ok when resource found
3334
| etag | "etag-index-css" |
3435
| cache-control | public, max-age=31536000, immutable |
3536

37+
Scenario: Should return 404 when rawPath is serviceroot
38+
Given enonic is running in production mode
39+
Given the following resources:
40+
| path | exist |
41+
| /assets | false |
42+
Given the following request:
43+
| property | value |
44+
| branch | master |
45+
| contextPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
46+
| host | localhost |
47+
| method | GET |
48+
| mode | live |
49+
| port | 8080 |
50+
| rawPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
51+
| scheme | http |
52+
| url | http://localhost:8080/webapp/com.example.myproject/_/service/com.example.myproject/asset |
53+
# Then log info the request
54+
# Given loglevel is set to "debug"
55+
When the request is sent
56+
# Then log info the response
57+
Then the response should have the following properties:
58+
| property | value |
59+
| status | 404 |
60+
61+
Scenario: Should return 404 when rawPath is serviceroot + /
62+
Given enonic is running in production mode
63+
Given the following resources:
64+
| path | exist |
65+
| /assets | false |
66+
Given the following request:
67+
| property | value |
68+
| branch | master |
69+
| contextPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
70+
| host | localhost |
71+
| method | GET |
72+
| mode | live |
73+
| port | 8080 |
74+
| rawPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset/ |
75+
| scheme | http |
76+
| url | http://localhost:8080/webapp/com.example.myproject/_/service/com.example.myproject/asset |
77+
# Then log info the request
78+
# Given loglevel is set to "debug"
79+
When the request is sent
80+
# Then log info the response
81+
Then the response should have the following properties:
82+
| property | value |
83+
| status | 404 |
84+
85+
Scenario: Should return 404 when rawPath is serviceroot + fingerprint
86+
Given enonic is running in production mode
87+
Given the following resources:
88+
| path | exist |
89+
| /assets | false |
90+
Given the following request:
91+
| property | value |
92+
| branch | master |
93+
| contextPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
94+
| host | localhost |
95+
| method | GET |
96+
| mode | live |
97+
| port | 8080 |
98+
| rawPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456 |
99+
| scheme | http |
100+
| url | http://localhost:8080/webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456 |
101+
# Then log info the request
102+
# Given loglevel is set to "debug"
103+
When the request is sent
104+
# Then log info the response
105+
Then the response should have the following properties:
106+
| property | value |
107+
| status | 404 |
108+
109+
Scenario: Should return 404 when rawPath is serviceroot + fingerprint + /
110+
Given enonic is running in production mode
111+
Given the following resources:
112+
| path | exist |
113+
| /assets | false |
114+
Given the following request:
115+
| property | value |
116+
| branch | master |
117+
| contextPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
118+
| host | localhost |
119+
| method | GET |
120+
| mode | live |
121+
| port | 8080 |
122+
| rawPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456/ |
123+
| scheme | http |
124+
| url | http://localhost:8080/webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456 |
125+
# Then log info the request
126+
# Given loglevel is set to "debug"
127+
When the request is sent
128+
# Then log info the response
129+
Then the response should have the following properties:
130+
| property | value |
131+
| status | 404 |
132+
133+
Scenario: Should return 404 when excess slashes
134+
Given enonic is running in production mode
135+
Given the following resources:
136+
| path | exist |
137+
| /assets///index.css | false |
138+
Given the following request:
139+
| property | value |
140+
| branch | master |
141+
| contextPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset |
142+
| host | localhost |
143+
| method | GET |
144+
| mode | live |
145+
| port | 8080 |
146+
| rawPath | /webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456///index.css |
147+
| scheme | http |
148+
| url | http://localhost:8080/webapp/com.example.myproject/_/service/com.example.myproject/asset/1234567890123456/index.css |
149+
# Then log info the request
150+
# Given loglevel is set to "debug"
151+
When the request is sent
152+
# Then log info the response
153+
Then the response should have the following properties:
154+
| property | value |
155+
| status | 404 |
156+
36157
Scenario: prefers brotli even though it comes last and have lowest qvalue weight
37158
Given enonic is running in production mode
38159
Given the following resources:

‎src/main/resources/lib/enonic/asset/resource/path/getAbsoluteResourcePathWithoutTrailingSlash.ts‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎src/main/resources/lib/enonic/asset/resource/path/prefixWithRoot.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ export function prefixWithRoot({
55
root = GETTER_ROOT,
66
path,
77
}: {
8-
path: string,
8+
path: string, // Can be empty string, or just a slash, or a full path starting with a slash
99
root?: string
1010
}): string {
1111
// NOTE: For security reasons it's very important that GETTER_ROOT is the root
@@ -15,7 +15,7 @@ export function prefixWithRoot({
1515
log.error(errorMessage);
1616
throw new Error(errorMessage);
1717
}
18-
return `/${root}/${path}`
19-
.replace(/\/\/+/g, '/') // Replace multiple slashes with a single slash
18+
const slashRoot = root.startsWith('/') ? root : `/${root}`;
19+
return `${slashRoot}${path}`
2020
.replace(/\/$/, ''); // Remove trailing slash
2121
}

‎src/main/resources/services/asset/requestHandler.ts‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ import {read} from '../../lib/enonic/asset/etagReader';
2020
import {getMimeType} from '../../lib/enonic/asset/io';
2121
import {getLowerCasedHeaders} from '../../lib/enonic/asset/request/getLowerCasedHeaders';
2222
import {checkPath} from '../../lib/enonic/asset/resource/path/checkPath';
23-
// import {getAbsoluteResourcePathWithoutTrailingSlash} from '../../lib/enonic/asset/resource/path/getAbsoluteResourcePathWithoutTrailingSlash';
2423
import {prefixWithRoot} from '../../lib/enonic/asset/resource/path/prefixWithRoot';
2524
import {getRelativeResourcePath} from '../../lib/enonic/asset/resource/path/getRelativeResourcePath';
2625
import {getRootFromPath} from '../../lib/enonic/asset/resource/path/getRootFromPath';
@@ -68,6 +67,7 @@ export function requestHandler({
6867
log.debug('relPath "%s"', relPath);
6968

7069
const rootPath = getRootFromPath(relPath);
70+
log.debug('rootPath "%s"', rootPath);
7171

7272
if (cacheBust) {
7373
if (rootPath === fingerprint) {
@@ -95,10 +95,7 @@ export function requestHandler({
9595
const root = configuredRoot();
9696
log.debug('root "%s"', root);
9797

98-
// const absResourcePathWithoutTrailingSlash = getAbsoluteResourcePathWithoutTrailingSlash({
99-
// request,
100-
// root
101-
// });
98+
log.debug('relPath2 "%s"', relPath);
10299
const absResourcePathWithoutTrailingSlash: string = prefixWithRoot({
103100
path: relPath,
104101
root,

0 commit comments

Comments
 (0)