Skip to content

Commit 284cf73

Browse files
tsegismontvietj
authored andcommitted
StaticHandler should not serve files under hidden directories
If the handler is configured to exclude hidden files, it should not only exclude hidden files, but also files under hidden directories. Signed-off-by: Thomas Segismont <tsegismont@gmail.com>
1 parent b3edd39 commit 284cf73

File tree

3 files changed

+12
-8
lines changed

3 files changed

+12
-8
lines changed

vertx-web/src/main/java/io/vertx/ext/web/handler/impl/StaticHandlerImpl.java

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -193,15 +193,16 @@ private void sendStatic(RoutingContext context, FileSystem fileSystem, String pa
193193

194194
if (!includeHidden) {
195195
file = getFile(path, context);
196-
int idx = file.lastIndexOf('/');
197-
String name = file.substring(idx + 1);
198-
if (name.length() > 0 && name.charAt(0) == '.') {
199-
// skip
200-
if (!context.request().isEnded()) {
201-
context.request().resume();
196+
for (int idx = file.indexOf('/'); idx >= 0; idx = file.indexOf('/', idx + 1)) {
197+
String name = file.substring(idx + 1);
198+
if (name.length() > 0 && name.charAt(0) == '.') {
199+
// skip
200+
if (!context.request().isEnded()) {
201+
context.request().resume();
202+
}
203+
context.next();
204+
return;
202205
}
203-
context.next();
204-
return;
205206
}
206207
}
207208

vertx-web/src/test/java/io/vertx/ext/web/handler/StaticHandlerTest.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,12 +131,14 @@ public void testCantGetHiddenPage() throws Exception {
131131
@Test
132132
public void testGetHiddenPageSubdir() throws Exception {
133133
testRequest(HttpMethod.GET, "/somedir/.hidden.html", 200, "OK", "<html><body>Hidden page</body></html>");
134+
testRequest(HttpMethod.GET, "/somedir/.hidden/otherpage.html", 200, "OK", "<html><body>Subdirectory other page</body></html>");
134135
}
135136

136137
@Test
137138
public void testCantGetHiddenPageSubdir() throws Exception {
138139
stat.setIncludeHidden(false);
139140
testRequest(HttpMethod.GET, "/somedir/.hidden.html", 404, "Not Found");
141+
testRequest(HttpMethod.GET, "/somedir/.hidden/otherpage.html", 404, "Not Found");
140142
}
141143

142144
@Test
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<html><body>Subdirectory other page</body></html>

0 commit comments

Comments
 (0)