We're updating the issue view to help you get more done. 

Runwar resolves full file system paths via the URL

Description

Origina l Runwar Issue #149

This only affects *nix OS's and will only serve files from the web root, but it potentially exposes the full path to the web root to a user who can guess the path.

1 http://localhost/Users/brad/Projects/mySite/css/fontawesome.css


That URL above works because the path

1 /Users/brad/Projects/mySite/css/fontawesome.css is a real

absolute path on the file system. However, it should not work. The mapped resource manager allows this because it strips off the cfmlDirsFile path from the start and determines that path lives within a content path we're serving files from. That may make sense in some internal uses cases but not from the URL. I'm unclear on whether the getResource() method of a io.undertow.server.handlers.resource.ResourceManager always gets relative paths, or needs to account for absolute paths as well.

 

Status

Assignee

Unassigned

Reporter

Miguel Mathus

Labels

None

Components

Priority

Minor