Skip to content

/ javalin

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Serving static aliased files (resolves #1086) #1090

Merged
merged 5 commits into from Oct 19, 2020
Merged

Serving static aliased files (resolves #1086) #1090

merged 5 commits into from Oct 19, 2020

Conversation

@sealedtx
Copy link
Contributor

@sealedtx sealedtx commented Oct 16, 2020

Resolves #1086
Added possibility to set alias checks to serve static files. Because ResourceHandler was called manually it was impossible to attach context to enable jetty's alias checks. So I re-implemented ResourceHandler.getResource() to check aliases set by user in StaticFileConfig during configuring Javalin config.

Example:

Javalin.create(config -> {
    // will serve successfully all aliased/linked files
    config.addStaticFiles("src/test/external/", Location.EXTERNAL, Collections.singletonList(new ContextHandler.ApproveAliases()));
    
   // will server only checked by custom rules aliased/linked files
   config.addStaticFiles("src/test/external/", Location.EXTERNAL, Collections.singletonList(new MyAliasCheck()));

   // won't server aliased/linked files
   config.addStaticFiles("src/test/external/", Location.EXTERNAL);
}).start(7070);
sealedtx added 2 commits Oct 16, 2020
@sealedtx
serving static aliased files
6a65e93
@sealedtx
minor fixes
Loading status checks…
5aaca6a
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 17, 2020

Thanks @sealedtx !

Can you think of any scenario where you want some addStaticFiles calls to follow symlinks, while others don't?

Maybe we can go for config.resolveSymlinksForStaticFiles = true as a general config option?

It would be nice if you could write all of the new functionality into a new class (SymlinkResourceHandler or AliasResourceHandler?), and only use that handler in case resolveSymlinksForStaticFiles is true.

That way we're sure the new functionality won't affect the old.
@tipsy
tipsy reviewed Oct 17, 2020
View changes
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Outdated Show resolved Hide resolved
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Outdated Show resolved Hide resolved
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 17, 2020

@tipsy I am not very experienced with serving aliased files and hardly even imagine the scenario when aliased files should be blocked. In my case I needed to allow aliased files.

scenario where you want some addStaticFiles calls to follow symlinks, while others don't

I understand, it looks like edge case. I just used to design code to cover as much cases as possible if it doesn't hurt any other aspects.
But I like your solution with config.resolveSymlinksForStaticFiles or mb config.allowAliasedStaticFiles to follow jetty's "allow" naming. I may commit changes today/tomorrow.
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 18, 2020 •
edited

@tipsy After reading this, I doubt about your suggestion. Moreover if it is known fact that Javalin uses directly jetty's ResourceHandler to serve static files, is it ok to add restrictions to fuctionallity (alias checks for security reasons)?

As a compromise solution:
changeconfig.resolveSymlinksForStaticFiles = true
to: config.aliasChecksForStaticFiles = listOf(AliasCheck)
or
to: config.aliasCheckForStaticFiles = AliasCheck
it will be single per javalin config, but user may specify different checks for different resources inside AliasCheck.check() if it is needed.
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 18, 2020

I'm okay with both of your suggestions @sealedtx, please go ahead and update the PR.
sealedtx added 2 commits Oct 18, 2020
@sealedtx
single AliasCheck instance per Javalin.config for all static files
Loading status checks…
7b0d872
@sealedtx
remove useless null check
Loading status checks…
e2c70d2
@tipsy
tipsy requested changes Oct 18, 2020
View changes
Copy link
Owner

@tipsy tipsy left a comment

All simLink should be replaced by symlink
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Outdated Show resolved Hide resolved
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Outdated Show resolved Hide resolved
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Show resolved Hide resolved
javalin/src/main/java/io/javalin/http/staticfiles/JettyResourceHandler.kt Outdated Show resolved Hide resolved
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 18, 2020

All simLink should be replaced by symlink

Why? There is no word symlink, even IDEA highlights it as typo.
I have seen a lot of sources with such naming including: org.eclipse.jetty.server.handler.AllowSymLinkAliasChecker
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 18, 2020

If I google symlink I get the Wikipedia entry (https://en.wikipedia.org/wiki/Symbolic_link) and 9 million hits. If I google simlink I get 200k hits and mostly non-related results. The camel-casing I don't care too much about, both SymLink and Symlink are fine, but as far as I can see it has to be spelled with a y, not an i.
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 18, 2020

@tipsy Oh sorry, my fail)
I misunderstood you, I didn't notice that typo, I thought you are talking about removing camelCase symLink to symlink.
@sealedtx
fix typo; make AliasResourceHandler extends PrefixableHandler
Loading status checks…
54669da
@tipsy
tipsy approved these changes Oct 18, 2020
View changes
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 18, 2020

Thank you @sealedtx, looks good! Let me know when you are ready for merge.
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 18, 2020

@tipsy I believe it is ready to merge
@sealedtx
Copy link
Contributor Author

@sealedtx sealedtx commented Oct 19, 2020

@tipsy Are you going to include this PR in the next release?
@tipsy tipsy merged commit 70b40b3 into tipsy:master Oct 19, 2020
18 checks passed
18 checks passed
build (1.8, windows-latest)
Details
build (1.8, macOS-latest)
Details
build (1.8, ubuntu-latest)
Details
build (9, windows-latest)
Details
build (9, macOS-latest)
Details
build (9, ubuntu-latest)
Details
build (10, windows-latest)
Details
build (10, macOS-latest)
Details
build (10, ubuntu-latest)
Details
build (11, windows-latest)
Details
build (11, macOS-latest)
Details
build (11, ubuntu-latest)
Details
build (12, windows-latest)
Details
build (12, macOS-latest)
Details
build (12, ubuntu-latest)
Details
build (13, windows-latest)
Details
build (13, macOS-latest)
Details
build (13, ubuntu-latest)
Details
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 19, 2020

@tipsy Are you going to include this PR in the next release?

Yes!
@tipsy
Copy link
Owner

@tipsy tipsy commented Oct 19, 2020

@sealedtx did some cleanup for resource handling: https://github.com/tipsy/javalin/pull/1092/files

This also fixes the case where you have both prefix-handlers and aliasing enabled.

Please have a look!
@tipsy
Copy link
Owner

@tipsy tipsy commented Nov 15, 2020

This is out now ! https://javalin.io/news/2020/11/14/javalin-3.12.0-released.html
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tipsy tipsy

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Linked issues

Successfully merging this pull request may close these issues.

Aliased Files and Symbolic links
2 participants
@sealedtx @tipsy