    001// Copyright 2006, 2007, 2008, 2010, 2011 The Apache Software Foundation
    002//
    003// Licensed under the Apache License, Version 2.0 (the "License");
    004// you may not use this file except in compliance with the License.
    005// You may obtain a copy of the License at
    006//
    007//     http://www.apache.org/licenses/LICENSE-2.0
    008//
    009// Unless required by applicable law or agreed to in writing, software
    010// distributed under the License is distributed on an "AS IS" BASIS,
    011// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    012// See the License for the specific language governing permissions and
    013// limitations under the License.
    014
    015package org.apache.tapestry5.internal.services;
    016
    017import java.io.IOException;
    018import java.net.URL;
    019
    020import javax.servlet.http.HttpServletResponse;
    021
    022import org.apache.tapestry5.TapestryConstants;
    023import org.apache.tapestry5.http.services.Context;
    024import org.apache.tapestry5.http.services.Request;
    025import org.apache.tapestry5.http.services.RequestFilter;
    026import org.apache.tapestry5.http.services.RequestHandler;
    027import org.apache.tapestry5.http.services.Response;
    028
    029/**
    030 * Identifies requests that are for actual resource files in the context. For those, Tapestry allows the servlet
    031 * container to process the request.
    032 */
    033public class StaticFilesFilter implements RequestFilter
    034{
    035    private final Context context;
    036
    037    public StaticFilesFilter(Context context)
    038    {
    039        this.context = context;
    040    }
    041
    042    public boolean service(Request request, Response response, RequestHandler handler)
    043            throws IOException
    044    {
    045        String path = request.getPath();
    046
    047        // TAPESTRY-1322: Treat requests from the browser for a favorites icon via the normal
    048        // servlet even if the file doesn't exist, to keep the request from looking like a
    049        // component action request.
    050
    051        if (path.equals("/favicon.ico")) return false;
    052
    053        // TAPESTRY-2606: A colon in the path is frequently the case for Tapestry event URLs,
    054        // but gives Windows fits.
    055
    056        if (!path.contains(":"))
    057        {
    058            // We are making the questionable assumption that all files to be vended out will contain
    059            // an extension (with a dot separator). Without this, the filter tends to match against
    060            // folder names when we don't want it to (especially for the root context path).
    061
    062            int dotx = path.lastIndexOf(".");
    063
    064            if (dotx > 0)
    065            {
    066                URL url = context.getResource(path);
    067
    068                if (url != null)
    069                {
    070                    String suffix = path.substring(dotx + 1);
    071
    072                    // We never allow access to Tapestry component templates, even if they exist.
    073                    // It is considered a security risk, like seeing a raw JSP. Earlier alpha versions
    074                    // of Tapestry required that the templates be stored in WEB-INF.
    075
    076                    if (suffix.equalsIgnoreCase(TapestryConstants.TEMPLATE_EXTENSION))
    077                    {
    078
    079                        response.sendError(HttpServletResponse.SC_FORBIDDEN, String.format("URI %s may not be accessed remotely.", path));
    080
    081                        return true;
    082                    }
    083
    084                    return false;
    085                }
    086            }
    087        }
    088
    089        return handler.service(request, response);
    090    }
    091}