Runwar resolves full file system paths via the URL

Description

Origina l Runwar Issue #149

This only affects *nix OS's and will only serve files from the web root, but it potentially exposes the full path to the web root to a user who can guess the path.


That URL above works because the path

absolute path on the file system. However, it should not work. The mapped resource manager allows this because it strips off the cfmlDirsFile path from the start and determines that path lives within a content path we're serving files from. That may make sense in some internal uses cases but not from the URL. I'm unclear on whether the getResource() method of a io.undertow.server.handlers.resource.ResourceManager always gets relative paths, or needs to account for absolute paths as well.

 

Status

Assignee

Unassigned

Reporter

Miguel Mathus

Labels

None

Components

Priority

Minor
Configure