Bug 271176 - [branding] servletName="/" exposes WEB-INF and other application specific folders
Summary: [branding] servletName="/" exposes WEB-INF and other application specific fol...
Status: RESOLVED INVALID
Alias: None
Product: RAP
Classification: RT
Component: RWT (show other bugs)
Version: 1.2   Edit
Hardware: All All
: P3 normal (vote)
Target Milestone: ---   Edit
Assignee: Project Inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords: needinfo
Depends on:
Blocks:
 
Reported: 2009-04-03 15:40 EDT by Kristian Rink CLA
Modified: 2009-09-18 04:31 EDT (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Rink CLA 2009-04-03 15:40:06 EDT 
Build ID: M20090211-1700

Steps To Reproduce:
Using RAP 1.2m6 with an extension like this...

[...]
   <extension
         point="org.eclipse.rap.ui.branding">
      <branding
            defaultEntrypointId="foo.entrypoint1"
            id="foo.Branding"
            servletName="/"
            title="foo">
      </branding>
   </extension>
[...]

allows for browsing the applications WEB-INF folder using

http://localhost:10080/WEB-INF or, in general, the 

application folder structure while just using an existing path, like

http://localhost:10080/WEB-INF/conf/W4T.xml

Not sure whether a RAP application is likely to contain critical information in there and/or whether a servletName like this is sane in the first place but eventually this should be addressed somehow...

More information:
Comment 1 Ivan Furnadjiev CLA 2009-04-07 09:40:31 EDT 
I can't reproduce it. When I set the servletName to "/" I get an exception:
!ENTRY org.eclipse.rap.ui 4 0 2009-04-07 16:37:39.552
!MESSAGE Could not register servlet mapping '/'.
!STACK 0
java.lang.IllegalArgumentException: Invalid alias '//'
	at org.eclipse.equinox.http.servlet.internal.ProxyServlet.checkAlias(ProxyServlet.java:166)
	at org.eclipse.equinox.http.servlet.internal.ProxyServlet.registerServlet(ProxyServlet.java:132)
	at org.eclipse.equinox.http.servlet.internal.HttpServiceImpl.registerServlet(HttpServiceImpl.java:59)
	.....
Comment 2 Rüdiger Herrmann CLA 2009-09-18 04:31:22 EDT 
We can't reproduce this problem (see comment #1)
Please feel free to re-open if you have additional information.